Reminder that you should have your authention setup in whatever you are developing before you bind to 0.0.0.0 or a routable address. Even if you trust all the p

Reminder that you should have your authention setup in whatever you are developing before you bind to 0.0.0.0 or a routable address. Even if you trust all the people and devices on your LAN. There are ways to port scan from within a webpage so it’s possible that someone on your LAN visits a malicious page and exposes your service to the internet as well. 127.* is treated as a different origin so doesnt have this problem. A decade a go many dev tools would bind to routable interfaces by default and this was frequently exploited. Loopback is a much safer default.