binding to "0.0.0.0" startupMessage reports "127.0.0.1" 🐛

[gregchalmers]

Fiber version
v2.5.0

Issue description
If I bind Listen to "0.0.0.0" startupMessage reports "127.0.0.1", but OS says it's bound to "0.0.0.0".

Code snippet

package main
import "github.com/gofiber/fiber/v2"
func main() {
  app := fiber.New()
  log.Fatal(app.Listen("0.0.0.0:8080"))
}

netstat

$ netstat -lnp | grep LISTEN | grep 8080
tcp        0      0 0.0.0.0:8080            0.0.0.0:*               LISTEN      189950/./main

output

 ┌───────────────────────────────────────────────────┐ 
 │                    Fiber v2.5.0                   │ 
 │               http://127.0.0.1:8080               │ 
 │                                                   │ 
 │ Handlers ............. 6  Processes ........... 1 │ 
 │ Prefork ....... Disabled  PID ............ 189363 │ 
 └───────────────────────────────────────────────────┘ 

code responsible in fiber/app.go

	host, port := parseAddr(addr)
	if host == "" || host == "0.0.0.0" {
		host = "127.0.0.1"
	}

[welcome]

Thanks for opening your first issue here! 🎉 Be sure to follow the issue template! If you need help or want to chat with us, join us on Discord https://gofiber.io/discord

[kiyonlin]

Do you want to see 0.0.0.0 in banner like #1198 do?

[gregchalmers]

ah right sorry yes same as #1198, sorry I didn't find the other one I should have searched the closed bugs as well.

I cannot really see how printing 127.0.0.1 when it's bound to 0.0.0.0 is valid.
127.0.0.1 == bind to the loopback device, i.e. gofiber is only accessible by processes on the same machine.
0.0.0.0 == bind to all network cards on that machine, i.e. the gofiber process is likely accessible to remote machines.

If someone uses 0.0.0.0 by mistake and the start banner says 127.0.0.1 this seems a security issue to me.
Also as in my case when I bind to 0.0.0.0 and I read the startup banner says 127.0.0.1 its confusing. Hence I checked with netstat to make sure I wasn't going crazy.

[kiyonlin]

The reason why we use 127.0.0.1, is that 0.0.0.0 can't be clicked on the terminal to open the address on a browser. I think we should treat them as two address (bound address and visit address) if necessary.

 ┌───────────────────────────────────────────────────┐ 
 │                    Fiber v2.5.0                   │ 
 │               http://127.0.0.1:8080               │ 
 │             bound http://0.0.0.0:8080             │ 
 │                                                   │ 
 │ Handlers ............. 6  Processes ........... 1 │ 
 │ Prefork ....... Disabled  PID ............ 189363 │ 
 └───────────────────────────────────────────────────┘ 

[gregchalmers]

Hi @kiyonlin thanks for explaining to me why. I did what you suggested, [here] I've only coded in Go for a week so you might want to check if it looks OK, and then I'll submit a PR.

Thanks