Devtunnel rewrites `localhost` location headers

[Jafferwaffer]

Summary

When a server behind devtunnel sends an HTTP redirect to http://localhost:3000/some-url, devtunnel rewrites the Location header to something like:

Location: https://mytunnel.devtunnels.ms:3000/some-url

This breaks the redirect if port 3000 is not forwarded.

In my express server (which is being port forwarded) I am calling res.redirect('http://localhost:3000/some-url') but in the browser the location header is being rewritten as described above.

Steps to Reproduce

1. Start a devtunnel on a port other than 3000.

2. Serve a backend on that port that does:

   res.redirect('http://localhost:3000/some-url');
   

3. Visit the devtunnel URL and trigger the redirect.

4. The browser is redirected to https://<your-tunnel>:3000/some-url and fails to load.

Expected Behavior

Redirects to localhost should remain unchanged

[derekbekoe]

@Jafferwaffer does https://github.com/microsoft/dev-tunnels/issues/284#issuecomment-1701506761 resolve your issue?

[Jafferwaffer]

Hey @derekbekoe it doesn't seem to. The steps I took were:

• start devtunnel devtunnel host -p 3001
• grab the id
• devtunnel update {id} --host-header unchanged

Tried the flow again & still ended up redirected to the devtunnel url on port 3000 which I haven't exposed instead of localhost

[graemefoster]

Just discovered this as-well. In my case I'm testing a local MCP server against MCP inspector. DevTunnel rewrites a legitimate 302 redirect Location response header.

It appears to me that DevTunnel rewrites ALL localhost occurrences with the devtunnel hostname. It should ONLY rewrite localhost:<FORWARDED-PORT> headers in my opinion,.

[Buckler89]

Has anyone got any updates about this? I’m in the same situation as @graemefoster . Have you managed to solve it in the meantime?

[graemefoster]

Hi @Buckler89 nope I couldn’t make it work. I switched to ngrok when I needed to get around this specific problem.