A permissive user-configured proxy with a broad context (e.g., '/') and `ws: true` intercepts the development server's own Hot Module Replacement (HMR) WebSocket and forwards it to the proxy target. This results in the leakage of the browser's cookies and Origin header to the backend and bypasses the development server's Host/Origin validation. Additionally, this causes corruption of the HMR socket as both the HMR and the proxy attempt to write to the same socket.