security: bind server to 127.0.0.1 so the tunnel/proxy basic-auth gate can't be bypassed on the LAN

b38a6f6645225e5dfc493df99c13437bcc0646ee · 2026-07-16 07:51:19 -0700 · Steve

Files touched

M server.js

Diff

commit b38a6f6645225e5dfc493df99c13437bcc0646ee
Author: Steve <steve@designerwallcoverings.com>
Date:   Thu Jul 16 07:51:19 2026 -0700

    security: bind server to 127.0.0.1 so the tunnel/proxy basic-auth gate can't be bypassed on the LAN
---
 server.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/server.js b/server.js
index f769a54..71ed874 100644
--- a/server.js
+++ b/server.js
@@ -241,7 +241,7 @@ http.createServer(async (req, res) => {
   }
 
   res.writeHead(404); res.end('not found');
-}).listen(PORT, function () {
+}).listen(PORT, '127.0.0.1', function () {
   console.log('[estimate-instant] http://localhost:' + this.address().port);
   console.log('  Calculator: http://localhost:' + this.address().port + '/');
   console.log('  Admin:      http://localhost:' + this.address().port + '/admin' + (BASIC_AUTH ? '  (auth required)' : '  (open — set BASIC_AUTH=user:pass to gate)'));

← 646c3eb shopify: add Buy N rolls CTA + TEST banner to calculator UI · back to Estimate Instant · auto-save: 2026-07-16T08:12:03 (1 files) — data/shopify-cata edeca0c →