webpack: Disable host check for webpack-dev-server.

[priyank-p]

Webpack dev server by default does host checking for requests. so
in dev environment, if the request came for zulipdev.com it would not
send js files which caused dev environment to not work.

[timabbott]

Ahh, OK, this is the issue that you thought was expose-loader being broken. Makes sense. I think for security reasons, we don't want to disable this unconditionally; instead, we should disable this only in the remote dev environment case (effectively, when run-dev.py --interface='' is what we're doing). Is there a way to pass this in as an option from the caller?

See webpack/webpack-dev-server#887 for details on the security issue.

[priyank-p]

Yeah, we can pass disable the option only when the the interface flag is --interface=''. The reason i disabled it as i though it was run-dev.py that handles the request passed to webpack-dev-server and django already will not accept request from any port that is not in EXTERNAL_HOST.

[timabbott]

Right, but someone could open a connection directly to the webpack port of 9994, not going through run-dev.py. Basically, it's a security problem to have that option disabled on your laptop, but not really a problem on a remote dev server. And it's a functionality problem the other way around. So basically we want this change if and only if --interface=''

[priyank-p]

We can also pass in a list of domains to whitelist ie .zulipdev.org, but is there a way to get hostnames to pass down without a flag? (From the EXTERNAL_HOST if we can would be great).

[timabbott]

I'm less excited about a domain whitelist than just having this setting be controlled by an option passed from run-dev.py, if that's a possibility.

[priyank-p]

@timabbott i updated this PR so that the tools/run-dev.py accepts --disable-host-check as well as tools/webpack.

This is flag is flipped on if interface='' but do we also want to do it where interface is None and the user is zulipdev and/or vagrant?

[timabbott]

Yes, we do. I think the right solution is to make the option conditional on the final value of options.interface, rather than a separate run-dev.py option. I did that tweak and merged this as
bc454ba. Can you verify that works for you?

[priyank-p]

This works for me, but I think we also need to let people who have droplets confirm this.

[timabbott]

Great; can you post in the original thread with @shubhamdhama that inspired this PR to make sure other folks test this?