Skip to content

AI prompts to fix your app

Followed a tutorial and your app won't open? You don't need to understand the details — paste one of these prompts into an AI assistant (Claude Code, GitHub Copilot, Cursor, or whatever you use) and it makes the changes for you.

Before you paste

Fill in two things with your own details:

  • Your web address — the one you want to open, e.g. app-lab1234.labs.decoded.com (or 8501-lab1234… if you're using a port number). Your lab number is in the addresses your instructor gave you.
  • Your port — 5000 for app-, or the number in <port>-lab….

The all-purpose prompt

Works for any kind of app — the assistant figures out what you're using and edits the right files. Copy it as-is, then change the two lines at the end.

I'm running this app on a Decoded lab VM. I open it in a browser at a URL like
https://app-lab1234.labs.decoded.com/ — never by IP or localhost — because a
reverse proxy sits in front of it. Change ONLY the configuration so it works in
that environment. Do not change the app's logic. Specifically:

1. Bind the server to host 0.0.0.0 (all interfaces), NOT 127.0.0.1 / localhost.
   The proxy connects to the app over the network, so a localhost-only bind is
   unreachable and shows a "Nothing on port N" page.
2. Listen on a port the proxy publishes: 5000 (reached as app-lab1234…), 5001-
   5005, 8100-8105, or any port in 2000-9000 (reached as <port>-lab1234…).
   Avoid 80, 22, 8001, 8002, 8003, 8005 — those are platform services.
3. Accept the external Host header "app-lab1234.labs.decoded.com". If the
   framework has a host / allowed-hosts allowlist, add that hostname (or, for
   dev only, allow all *.labs.decoded.com).
4. Assume HTTPS via a proxy: trust X-Forwarded-Proto and X-Forwarded-For so
   redirects, absolute URLs and secure cookies use https://, not http://.
5. In the frontend, don't hardcode http://localhost:PORT — use relative,
   same-origin URLs.
6. If there's hot-reload or a dev WebSocket, make its client connect over wss
   to the public host on port 443, not ws://localhost.

First tell me which framework/stack you detect from the files here, then show
the exact files and lines to change and why.

My real lab URL is:  https://app-lab1234.labs.decoded.com/
My app's port is:    5000

Framework add-ons

Already know what your app is built with? Add the matching block to the prompt above so the assistant goes straight to the right settings.

This is a Python web app (Flask / FastAPI / Uvicorn / Gunicorn).
- Flask: app.run(host="0.0.0.0", port=5000); add Werkzeug ProxyFix
  (x_for=1, x_proto=1, x_host=1) so external URLs are https.
- FastAPI/Uvicorn: run with --host 0.0.0.0 --port 5000 --proxy-headers
  --forwarded-allow-ips="*".
- Gunicorn: -b 0.0.0.0:5000 --forwarded-allow-ips="*".

This is a Django project. In settings.py set:
  ALLOWED_HOSTS = ["app-lab1234.labs.decoded.com"]   (or ["*"] for dev)
  CSRF_TRUSTED_ORIGINS = ["https://app-lab1234.labs.decoded.com"]
  SECURE_PROXY_SSL_HEADER = ("HTTP_X_FORWARDED_PROTO", "https")
Run with: python manage.py runserver 0.0.0.0:5000
(The ALLOWED_HOSTS / CSRF_TRUSTED_ORIGINS host must match the URL I open;
 CSRF_TRUSTED_ORIGINS is required or admin login / form POSTs 403 over HTTPS.)

This is a Node/Express app. Call app.set("trust proxy", 1) and
app.listen(5000, "0.0.0.0"). No host allowlist is needed.

This uses Vite. In vite.config.js set server.host = true (0.0.0.0),
server.port = 5173, server.allowedHosts = [".labs.decoded.com"], and
server.hmr = { protocol: "wss", clientPort: 443 } so hot-reload works
through the HTTPS proxy.

Next.js: run `next dev -H 0.0.0.0 -p 3000`; if it warns about cross-origin
dev requests, add allowedDevOrigins:["3000-lab1234.labs.decoded.com"] to
next.config.js.
Create React App: start with HOST=0.0.0.0 PORT=3000 WDS_SOCKET_PORT=443
DANGEROUSLY_DISABLE_HOST_CHECK=true.

Streamlit: streamlit run app.py --server.address 0.0.0.0 --server.port 8501
  --server.headless true --server.enableCORS false
  --server.enableXsrfProtection false
Gradio: demo.launch(server_name="0.0.0.0", server_port=7860)
Jupyter: jupyter lab --ip 0.0.0.0 --port 8888 --no-browser
  --ServerApp.allow_origin='*' --ServerApp.trust_xheaders=True

When it still doesn't load

Ask the assistant to help you read the symptom:

My app at https://app-lab1234.labs.decoded.com/ still doesn't work. Here's what
I see: <PASTE the browser message and, if you can, the output of
`ss -tlnp | grep :5000` run on the VM>. Based on that, tell me whether the app
is bound to localhost instead of 0.0.0.0, listening on the wrong port, or
rejecting the Host header — and give me the one change to fix it.

The Troubleshooting page lists the common symptoms and what each one means.