I've noticed an issue with the allowedDevOrigins update, as it breaks the network development by default. I've filed an issue under https://github.com/vercel/next.js/issues/96241.

I got a comment that says that the documentation mentions this to be intentional, although I interpreted it differently. What is this "unauthorized access" we are guarding against? And shouldn't we block the rest of the application as well (because we now only block Webpack/Turbopack HRM)?

I believe that we should allow local development by default, including across a network. Does anyone think differently, and why?