Always binding to all addresses, the way the command line server currently does, can be a security problem, depending on who is on the same LAN. Even if the offline option is given and the only URLs printed to the user refer to localhost, the server still listens on all available addresses. It would be nice if one could pass a suitable host name or address to the listen method invocation, and ideally if this were exposed to the CLI as well. At the very least, the server should be able to bind to localhost only. As a second step, it might make sense to allow binding to an arbitrary IP address, like e.g. the one of a virtual Docker network used for development.
This feature request is analogous to isaacs/st#74, but since BrowserSync is far more complicated, I'm having some trouble finding all the right places to hook this up, with the CLI in particular. I'm also not sure how to name the options to integrate with the overall structure of the config.
Always binding to all addresses, the way the command line server currently does, can be a security problem, depending on who is on the same LAN. Even if the
offlineoption is given and the only URLs printed to the user refer to localhost, the server still listens on all available addresses. It would be nice if one could pass a suitable host name or address to thelistenmethod invocation, and ideally if this were exposed to the CLI as well. At the very least, the server should be able to bind tolocalhostonly. As a second step, it might make sense to allow binding to an arbitrary IP address, like e.g. the one of a virtual Docker network used for development.This feature request is analogous to isaacs/st#74, but since BrowserSync is far more complicated, I'm having some trouble finding all the right places to hook this up, with the CLI in particular. I'm also not sure how to name the options to integrate with the overall structure of the config.