bind to lo interface only

[akomm]

Issue details

I'm using the following config:

browserSync({
  port: 3000,
  host: '127.0.0.1',
  ui: {
    port: 3001
  },
  /* ... */
});

Starting the server with this config gives me the following feedback in terminal:

 ----------------------------------
       Local: http://localhost:3000
    External: http://127.0.0.1:3000
 ----------------------------------
          UI: http://localhost:3001
 UI External: http://127.0.0.1:3001
 ----------------------------------

The server is accessible via ALL interfaces on the machine.

Steps to reproduce/test case

Run the server with the given configuration (see above and below)

Please specify which version of Browsersync, node and npm you're running

• Browsersync 2.18.5
• Node 7.10.0
• Npm 4.2.0

Affected platforms

• linux
• windows
• OS X
• freebsd
• solaris

Browsersync use-case

• API
• Gulp
• Grunt
• CLI

for all other use-cases, (gulp, grunt etc), please show us exactly how you're using Browsersync

import browserSync from 'browser-sync';
import historyApiFallback from 'connect-history-api-fallback';
import webpack from 'webpack';
import webpackDevMiddleware from 'webpack-dev-middleware';
import webpackHotMiddleware from 'webpack-hot-middleware';
import config from '../webpack.config.dev';

const bundler = webpack(config);

browserSync({
  port: 3000,
  host: '127.0.0.1',
  ui: {
    port: 3001
  },
  server: {
    baseDir: 'src',

    middleware: [
      historyApiFallback(),

      webpackDevMiddleware(bundler, {
        publicPath: config.output.publicPath,
        noInfo: false,
        quiet: false,
        stats: {
          assets: false,
          colors: true,
          version: false,
          hash: false,
          timings: false,
          chunks: false,
          chunkModules: false
        },
      }),
      webpackHotMiddleware(bundler)
    ]
  },
  files: [
    'src/*.html'
  ]
});

[vbraun]

This is not specific to lo, browsersync seems to alway ignore the host setting and binds 0.0.0.0 instead. Which is a pita if you have multiple interfaces (e.g. your computer also hosting containers and virtual machines, suddenly port 3000 is blocked for everyone) and a security issue as noted on #1132

[shakyShane]

Hi all, please see the following comment #1431 (comment)

[shakyShane]

Fixed with the new 'listen' option

npm i -g browser-sync@2.25.0
browser-sync . --listen localhost