fix: keep this package's name and its refusals in the browser console

Two things the browser used to say that the middleware's runtime had no way
to say for it.

The console prefix: every message read `[webpack-dev-server]`, and four
snapshots record exactly that, including `Invalid Host/Origin header` — a line
people search for. Taking the runtime as-is would relabel all of it with a
dependency's name and send anyone with a problem to the wrong repository, so
the name travels with the logging option.

The refusal itself: a client turned away by `allowedHosts` or the origin check
is told why, and the reason is logged in the page. That needs the handshake to
complete, so the upgrade is answered even for a client that will be refused
and `guardHotEndpoint` closes it immediately after saying so — which is what
this server has always done. Owning the `upgrade` listener is still what keeps
a proxied upgrade with whoever it belongs to; `isHotEndpoint` went with the
earlier attempt to refuse before the handshake, which would have made the
reason unreachable.

Verified in a browser: the console carries `[webpack-dev-server]`, and a
client from a disallowed origin receives
`{"action":"error","message":"Invalid Host/Origin header"}` and is closed.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UjuMAuk9o6UazjHzcAQCTA

Author: alexander-akait

lib/Server.js

@@ -2455,37 +2455,6 @@ class Server {
     });
   }
 
-  /**
-   * Whether an upgrade was addressed to the hot endpoint.
-   *
-   * Compared the way `ws` compares it in `shouldHandle`: the raw target with
-   * the query string removed, case-sensitively. Normalizing here would claim
-   * url variants (`//ws`, `/WS`) that the socket itself refuses, which would
-   * take them from whoever they really belong to.
-   * @private
-   * @param {IncomingMessage} req the upgrade request
-   * @returns {boolean} whether it was for the hot endpoint
-   */
-  isHotEndpoint(req) {
-    const webSocketServer =
-      /** @type {WebSocketServerConfiguration} */
-      (this.options.webSocketServer);
-    const serverOptions =
-      /** @type {NonNullable<WebSocketServerConfiguration["options"]>} */
-      (webSocketServer && webSocketServer.options) || {};
-    const path = serverOptions.prefix || serverOptions.path || "/ws";
-
-    if (typeof req.url !== "string") {
-      return false;
-    }
-
-    const queryIndex = req.url.indexOf("?");
-
-    return (
-      (queryIndex === -1 ? req.url : req.url.slice(0, queryIndex)) === path
-    );
-  }
-
   /**
    * Judge every client that reaches the hot endpoint.
    *
@@ -2540,11 +2509,14 @@ class Server {
             (!this.isValidHost(headers, "origin") ||
               !this.isSameOrigin(headers)))
         ) {
+          // Said to the client before it is closed, so the reason reaches the
+          // page rather than only this server's log — a refusal that closes
+          // silently is one the developer has nowhere to read.
           this.sendMessage([client], "error", "Invalid Host/Origin header");
 
-          // With https enabled, the sendMessage above is encrypted
-          // asynchronously so not yet sent. Terminate would prevent it
-          // sending, so use close to allow it to be sent.
+          // With https enabled, the message above is encrypted asynchronously
+          // so not yet sent. Terminate would prevent it sending, so use close
+          // to allow it to be sent.
           client.close();
         }
       },
@@ -3197,7 +3169,16 @@ class Server {
     for (const client of clients) {
       // `ws` uses `WebSocket.OPEN`, which is `1`
       if (client.readyState === 1) {
-        message ??= JSON.stringify({ type, data, params });
+        message ??= JSON.stringify(
+          // The runtime reading this is webpack-dev-middleware's, which
+          // dispatches on `action`. `error` is the one type this server still
+          // sends itself — a refusal it decided on, which no build knows
+          // about — so it goes over in the shape that runtime logs rather
+          // than as an action it would drop.
+          type === "error"
+            ? { action: "error", message: data }
+            : { type, data, params },
+        );
         client.send(message);
       }
     }
@@ -3442,27 +3423,14 @@ class Server {
           return;
         }
 
-        const headers =
-          /** @type {{ [key: string]: string | undefined }} */
-          (req.headers);
-
-        // A handshake is not subject to the browser's own origin rules — it
-        // sends `Origin` and pays no attention to what comes back — so this is
-        // the only place it can be refused.
-        if (
-          !this.isValidHost(headers, "host") ||
-          !this.isValidHost(headers, "origin") ||
-          !this.isSameOrigin(headers)
-        ) {
-          // Only a request that was for the hot endpoint is ours to refuse.
-          // Anything else belongs to a proxy or to another listener.
-          if (this.isHotEndpoint(req)) {
-            socket.destroy();
-          }
-
-          return;
-        }
-
+        // Answered rather than refused here, even for a client that will be
+        // turned away: the handshake has to complete for the reason to reach
+        // the page, which is where someone debugging a dev server reads it.
+        // `guardHotEndpoint` closes it immediately afterwards, having said so.
+        //
+        // The server is not handed over with `attach` even so, because owning
+        // this listener is what keeps an upgrade that was never ours — a
+        // proxied one — with whoever it belongs to.
         middleware.handleUpgrade(req, socket, head);
       });
 

lib/hotOptions.js

@@ -224,9 +224,13 @@ export default function hotOptions({
     overlay: clientOverlay(client.overlay),
   };
 
-  if (client.logging !== undefined) {
-    result.client.logging = client.logging;
-  }
+  // The level, plus the name every message is labelled with: this package is
+  // the one a developer installed, so the console says so rather than naming
+  // a dependency they would not think to report a problem to.
+  result.client.logging = {
+    name: "webpack-dev-server",
+    ...(client.logging === undefined ? {} : { level: client.logging }),
+  };
 
   if (client.progress !== undefined) {
     result.client.progress = client.progress;