Add Host Configuration Option for Enhanced Security with Nginx Reverse Proxy

[moemoequte]

I am currently using Casdoor and noticed that it only allows configuration of the listening port, defaulting to listen on 0.0.0.0. This setup makes it challenging to securely configure Casdoor behind an Nginx reverse proxy without exposing additional ports to the outside network.

Issue Description:

• The application lacks an option to configure the listening host address. It is always set to listen on all interfaces (0.0.0.0).
• This behavior poses a security risk as it potentially exposes the application to unwanted external access.

Proposed Solution: I propose adding a configuration option that allows users to specify the listening host address. For instance, being able to set the host to 127.0.0.1 would enable the application to only listen on the local machine, thus enhancing security when using reverse proxies like Nginx.

Benefits:

• Increased security by restricting access to the application via network configuration.
• Flexibility for users who need to deploy behind reverse proxies without exposing the app on public networks.

I believe this feature would be beneficial for many users who are looking to secure their Casdoor deployments more effectively. Looking forward to your thoughts on this.

Thank you for considering this enhancement.

[casbin-bot]

@tangyang9464 @JalinWang @imp2002

[hsluoyz]

@moemoequte modify this line: https://github.com/casdoor/casdoor/blob/bfcfb56336799ff24068f06e7d1aaa214d75d4ff/main.go#L88

to: beego.Run(fmt.Sprintf("127.0.0.1:%v", port))

No need to add config, there are already too many configs.

It's listening to 8000 by default. But if you don't open that port in your OS, it will not be unsecure. So the root cause is still on YOU!

[alfredosola]

I have to disagree. Security is layered. Unless someone explicitly installs a firewall, casdoor will happily listen on http-alt and respond there. It should be safe by default, not requiring additional steps for hardening. Take a look e.g. at Debian's packaging of Mysql/MariaDB: it only listens on localhost by default.