-
Notifications
You must be signed in to change notification settings - Fork 12k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Listen on Host 0.0.0.0 by default #1475
Conversation
Before webpack, the server used to bind to 0.0.0.0 by default to allow connecting via network IPs like 192.168.5.1. This makes it easier to develop mobile applications as you can just connect to the same network and access via IP.
@TheLarkInn can you review? |
Does this not work currently if you set --host='0.0.0.0' @intellix ? |
Never mind that last statement I had to lookup of setting 0.0.0.0 will allow you to goto localhost:port in the browser and it looks like it will. |
I'd prefer if the smallest set of interfaces were bound by default (i.e., localhost). Unintentionally (and potentially unknowingly) exposing under development projects is generally not a good security practice. However, I do understand the use case outlined above. I think a better option would be to add a default host option to the angular-cli.json file (and default that to localhost). |
A couple of dev servers that bind to 0.0.0.0 by default from checking:
Typically when you serve anything, you get a message like:
I've never come across something that wasn't available on 192.x out of the box before :) |
All of which have the same flaw in a development setting. |
It is probably better to not bind to 0.0.0.0 by default. There are good security arguments and so on. However, I recommend setting that aside for the moment, and aiming for the same convenience as the competing tools for other frameworks, that @intellix mentioned. Why? Because the hard part at the start of a new thing is getting users. Adding yet another thing that people have to mess with if they use angular-cli, which "just work" with other tools, is not a good way to get users. |
The typical development use case is to open the web app in a local browser. This is covered with localhost. It's better to put secure defaults in place early than cause disruptions down the line. Also of note, the AngularClass angular2-webpack-starter (which many currently use) defaults to localhost. |
I'll have to agree with @clydin and @kylecordes on this one. I think that although out of the box, this will probably not impact any user, but opening additional endpoints by default is really not the best practice from a security standpoint. If you are looking for an avenue of convenience you could simply add a npm script you can execute that runs:
For the sake of the every day user, I think its best to leave at "localhost". When we have our plugin/addon system more fleshed out @intellix I would love to work with you to help implement a plugin/addon that gives you these features by default. |
I'm also of the opinion that there is little benefit in defaulting to I've personally been in a situation at a FinTech company where default network access to local servers was a problem. No one knew it was happening, it was just default. Unless there's stronger arguments provided, I think this PR should not go in. |
I'm going to close this. @hansl if you disagree with or see any reason otherwise please feel to reopen. |
you drive a hard bargain! guess it would be good to mention in the migration doc :) |
Thank you very much that is definitely needed. |
It seems like it still says that it listens on all interfaces which is a bit misleading... |
and
|
Apparently, whatever I'm doing to install |
Actually, is it possible that the version isn't being updated before pushing to npm? Even if I |
Used: |
Seeing |
This issue has been automatically locked due to inactivity. Read more about our automatic conversation locking policy. This action has been performed automatically by a bot. |
Before webpack, the server used to bind to 0.0.0.0 by default to allow connecting via network IPs like 192.168.5.1.
This makes it easier to develop mobile applications as you can just connect to the same network and access via IP.