Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Internal web server should listen on 127.0.0.1, not 0.0.0.0 #2785

Closed
dnnr opened this issue Sep 28, 2020 · 2 comments
Closed

Internal web server should listen on 127.0.0.1, not 0.0.0.0 #2785

dnnr opened this issue Sep 28, 2020 · 2 comments

Comments

@dnnr
Copy link

dnnr commented Sep 28, 2020

It seems that a commit from March (5a5a5c9) inadvertently changed the default listening interface from localhost to 0.0.0.0, meaning every network interface available.

This is an unsafe default and a potential security risk (information disclosure), especially since there appears to be no obvious/documented way to change this behavior, except for modifying the source.

Please consider making 127.0.0.1 the default again. Thanks.

@cashcat
Copy link
Contributor

cashcat commented Nov 21, 2021

but how to start with 0.0.0.0?

@hakimel
Copy link
Owner

hakimel commented Nov 24, 2021

We now default to localhost but you can use any host you want as of #3075:

npm start -- --host=0.0.0.0

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

3 participants