5 ms·

I'm not super familiar with express but this seems to be listening on external interfaces as well: https://github.com/soorajshankar/logScreen/blob/f8b29aaef428

I'm not super familiar with express but this seems to be listening on external interfaces as well: https://github.com/soorajshankar/logScreen/blob/f8b29aaef4284b92d1010ac372304c3765810404/index.js#L17 https://github.com/soorajshankar/logScreen/blob/f8b29aaef428... So this will be sharing your logs with the world if you run this outside of a trusted network. (And personally I avoid trusting any networks)

soorajsanker 3y ago
Are you talking about the difference between 0.0.0.0 and 127.0.0.1 /localhost (loopback address)? If so It should be a tiny thing to change to implement I can add that on the next update- I just went with the express JS defaults to keep things simple:) Or I can even make a flag to configure this :thinking
- ggpsv 3y ago
  `app.listen` uses the same signature as Node's `server.listen`. You can specify the `host` [0] or else it defaults to `0.0.0.0`. This means that when you run this service, it will be accessible to anyone that can reach the server. Typically, services allow you set the host address by configuration. This way you can set it to `127.0.0.1` so that it is only available locally. [0]: https://nodejs.org/api/net.html#serverlistenport-host-backlog-callback https://nodejs.org/api/net.html#serverlistenport-host-backlo...
- gothink 3y ago
  If you do make it configurable, it's still a good idea to make the default `127.0.0.1` for the reasons @ggpsv mentioned. Since the link automatically opens at `http://localhost:PORT http://localhost:PORT` anyway, it's an easy security win.
Calzifer 3y ago
It does, but express doesn't tell it directly in the docs. Instead http://expressjs.com/en/4x/api.html#app.listen http://expressjs.com/en/4x/api.html#app.listen sends you to https://nodejs.org/api/http.html#http_server_listen https://nodejs.org/api/http.html#http_server_listen which also won't give the answer but sends you to https://nodejs.org/api/net.html#serverlisten https://nodejs.org/api/net.html#serverlisten which at some points finally documents that default is 0.0.0.0. Welcome to the JavaScript ecosystem :/
- throwitaway1123 3y ago
  I wouldn't exactly call this a failure of the JS ecosystem. The Express documentation you've linked to mentions that the host is the (optional) second argument to the listen function: > app.listen([port[, host[, backlog]]][, callback]) You literally just have to run: app.listen(3000, '127.0.0.1') If you don't trust the network you're on you should just be explicit about which IP address you'd like to listen on.
- stevage 3y ago
  That's a sensible default. It would be super frustrating if by default the web server you built couldn't be accessed by anyone else in your network.

soorajsanker 3y ago

Are you talking about the difference between 0.0.0.0 and 127.0.0.1 /localhost (loopback address)? If so It should be a tiny thing to change to implement I can add that on the next update- I just went with the express JS defaults to keep things simple:) Or I can even make a flag to configure this :thinking

ggpsv 3y ago
`app.listen` uses the same signature as Node's `server.listen`. You can specify the `host` [0] or else it defaults to `0.0.0.0`. This means that when you run this service, it will be accessible to anyone that can reach the server. Typically, services allow you set the host address by configuration. This way you can set it to `127.0.0.1` so that it is only available locally. [0]: https://nodejs.org/api/net.html#serverlistenport-host-backlog-callback https://nodejs.org/api/net.html#serverlistenport-host-backlo...
gothink 3y ago
If you do make it configurable, it's still a good idea to make the default `127.0.0.1` for the reasons @ggpsv mentioned. Since the link automatically opens at `http://localhost:PORT http://localhost:PORT` anyway, it's an easy security win.

Calzifer 3y ago

It does, but express doesn't tell it directly in the docs. Instead http://expressjs.com/en/4x/api.html#app.listen http://expressjs.com/en/4x/api.html#app.listen sends you to https://nodejs.org/api/http.html#http_server_listen https://nodejs.org/api/http.html#http_server_listen which also won't give the answer but sends you to https://nodejs.org/api/net.html#serverlisten https://nodejs.org/api/net.html#serverlisten which at some points finally documents that default is 0.0.0.0. Welcome to the JavaScript ecosystem :/

throwitaway1123 3y ago
I wouldn't exactly call this a failure of the JS ecosystem. The Express documentation you've linked to mentions that the host is the (optional) second argument to the listen function: > app.listen([port[, host[, backlog]]][, callback]) You literally just have to run: app.listen(3000, '127.0.0.1') If you don't trust the network you're on you should just be explicit about which IP address you'd like to listen on.
stevage 3y ago
That's a sensible default. It would be super frustrating if by default the web server you built couldn't be accessed by anyone else in your network.