simonrob / email-oauth2-proxy

An IMAP/POP/SMTP proxy that transparently adds OAuth 2.0 authentication for email clients that don't support this method.
Apache License 2.0
797 stars 86 forks source link

Only listen on loopback interface by default #194

Closed bemoody closed 11 months ago

bemoody commented 1 year ago

Thanks for developing this tool!

I think it would be wiser to only accept connections from the local system by default (do the less risky thing for people who don't read the documentation.)

If the example config file specified local_address = 127.0.0.1, that should work for the majority of people, and the rest can easily see how to change it if they need to.

simonrob commented 1 year ago

Thanks for this suggestion. The original reason for the removal of local_address = localhost was that issues kept being raised that ultimately were down to confusion over IPv6 vs. IPv4, which people were often not aware of. But I think you do make an interesting point, and using the IPv4 address would avoid localhost mapping issues. I'll consider this for the next version (it'll need a bit of rewriting of documentation too to explain).