search

lwsjs / local-web-server

A lean, modular web server for rapid full-stack development.
MIT License
1.21k stars 85 forks source link

Add ability to configure which hostname/IP the server listens on #55

Closed mrin9 closed 7 years ago

mrin9 commented 7 years ago

Is there a way I can bind the server to 0.0.0.0 address with http-server, we do this -a flag http-server -a 0.0.0.0

with webpack-dev-server we do this with --host flag webpack-dev-server --host 0.0.0.0

This would be very useful when we deploy it inside containers

mrin9 commented 7 years ago

Just tested, it serves from both, the localhost and the public IP. So no need to have that flag, however if someone really like to use it as a local-web-server then there should be a way to serve from only localhost.

Closing this issue

75lb commented 7 years ago

local-web-server binds to 0.0.0.0 by default, therefore it listens all available hostnames (127.0.0.1, localhost, external IPs, hostname, whatever is in /etc/hosts).

However, I like your idea to make this configurable so re-opening. thanks.

christophgysin commented 7 years ago

I can look into this.

It would also be good practice to bind to localhost only by default (secure defaults). That would require people who want their local webserver to be available outside of their machine to explicitly set ---address 0.0.0.0.

75lb commented 7 years ago

this is resolved by the --hostname option in v2 which is in progress and available for preview.. any feedback welcome.

christophgysin commented 7 years ago

this is resolved by the --hostname option in v2 which is in progress and available for preview https://github.com/lwsjs/local-web-server/tree/next.. any feedback welcome.

​Nice! Tested, works as expected.

I would rename to option though, --hostname is confusing. The socket is bound to an IP address, not a hostname. Specifying a hostname requires a DNS lookup, which really makes no sense in this case.

In other tools, this option is usually called --bind, --listen or --address (with --bind being the most common).

​Also, from a security standpoint, a good habit would be to bind to localhost by default, and not expose the server to the outside. -- echo mailto: NOSPAM !#$.'<>'|sed 's. ..'|tr "<> !#:2" org@fr33z3

75lb commented 7 years ago

hi.. I use hostname because its value is passed directly to the hostname option of server.listen.. but i take your point about names that users are more familiar with, i will look into it.

75lb commented 7 years ago

fixed and released in v2.0.0