4 ms·
Thanks for your comment. I surely hope no one will even consider using this server for anything public-facing :) It's solely for testing on localhost. The shut
by eliben 3y ago
Thanks for your comment. I surely hope no one will even consider using this server for anything public-facing :) It's solely for testing on localhost.
The shutdown endpoint is used for robust testing; I suppose I can hide it a bit more, like using an environment variable or something.
- d-z-m 3y agoIt's fine the way it is IMO. However, it might be worth caveating in the README that it's for local testing only, the same way you do in your blog post. Mainly because of the shutdown endpoint, but also that the -cors flag returns "Access-Control-Allow-Origin: *" exposing you to arbitrary cross origin requests.
- gabereiser 3y agoJust check a header for a secret key you generate when you startup. Easy peasy. This keeps you able to call it for testing (granted you read from stdout or passed the key to tests as a variable). Then some scripto ransomware User from Omgodisztan doesn’t shutdown your server from the tent he’s camped in with Starlink.
- eliben 3y agoThis is done now, thanks for the suggestion
- midwit 3y agoA simple middleware hook for http basic auth :)