fix: preserve HTTPS/HTTP2 host port in vite-plugin requests

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: intrdx

.changeset/fix-https-http2-host-port.md

@@ -0,0 +1,5 @@
+---
+"@cloudflare/vite-plugin": patch
+---
+
+Preserve the host and non-default port (e.g. `localhost:5173`) when the Vite dev server runs over HTTPS/HTTP2, so authentication flows such as Clerk no longer redirect-loop to the wrong origin

packages/vite-plugin-cloudflare/src/__tests__/utils.spec.ts

@@ -106,9 +106,11 @@ describe("createRequestHandler", () => {
 	let httpServer: http.Server;
 	let port: number;
 	let capturedUrls: string[];
+	let capturedForwardedHosts: (string | null)[];
 
 	beforeEach(async () => {
 		capturedUrls = [];
+		capturedForwardedHosts = [];
 	});
 
 	afterEach(async () => {
@@ -117,13 +119,15 @@ describe("createRequestHandler", () => {
 		);
 	});
 
-	function startServer() {
+	function startServer(mutateReq?: (req: http.IncomingMessage) => void) {
 		const handler = createRequestHandler(async (request) => {
 			capturedUrls.push(request.url);
+			capturedForwardedHosts.push(request.headers.get("X-Forwarded-Host"));
 			return new MiniflareResponse("OK");
 		});
 
 		httpServer = http.createServer((req, res) => {
+			mutateReq?.(req);
 			void handler(
 				req as unknown as Parameters<typeof handler>[0],
 				res,
@@ -188,4 +192,27 @@ describe("createRequestHandler", () => {
 		});
 		expect(capturedUrls[0]).toBe(`http://127.0.0.1:${port}/path`);
 	});
+
+	test("preserves non-default port from `:authority` when `Host` is missing", async ({
+		expect,
+	}) => {
+		await startServer((req) => {
+			delete req.headers.host;
+			req.headers[":authority"] = "localhost:5173";
+		});
+		await fetch(`http://127.0.0.1:${port}/path`);
+		expect(capturedUrls[0]).toBe("http://localhost:5173/path");
+		expect(capturedForwardedHosts[0]).toBe("localhost:5173");
+	});
+
+	test("preserves non-default port from the `Host` header", async ({
+		expect,
+	}) => {
+		await startServer((req) => {
+			req.headers.host = "localhost:5173";
+		});
+		await fetch(`http://127.0.0.1:${port}/path`);
+		expect(capturedUrls[0]).toBe("http://localhost:5173/path");
+		expect(capturedForwardedHosts[0]).toBe("localhost:5173");
+	});
 });

packages/vite-plugin-cloudflare/src/utils.ts

@@ -97,7 +97,25 @@ export function createRequestHandler(
 			// If the header is absent or invalid, `createRequest` falls back to the
 			// connection protocol (`req.socket.encrypted`).
 			const protocol = getForwardedProto(req);
-			request = createRequest(req, res, protocol ? { protocol } : undefined);
+			// Prefer Node host/:authority so HTTPS/HTTP2 keeps non-default ports (e.g. :5173).
+			// createHeaders() skips pseudo-headers, so Host can be missing and X-Forwarded-Host
+			// would otherwise not preserve the Vite origin port used by auth libraries (Clerk).
+			const nodeHost =
+				typeof req.headers.host === "string" ? req.headers.host : undefined;
+			const authority =
+				typeof req.headers[":authority"] === "string"
+					? req.headers[":authority"]
+					: undefined;
+			const host = nodeHost ?? authority;
+
+			request = createRequest(req, res, {
+				...(protocol ? { protocol } : {}),
+				...(host ? { host } : {}),
+			});
+
+			if (host && !request.headers.has("Host")) {
+				request.headers.set("Host", host);
+			}
 
 			let response = await handler(toMiniflareRequest(request), req);