Wizard: listen on both IPv4 and IPv6 loopback so localhost resolves

069360c5fd5e837ef89fda91a267ef49e31161fc · 2026-05-19 09:07:34 -0700 · Steve

Files touched

M server.js

Diff

commit 069360c5fd5e837ef89fda91a267ef49e31161fc
Author: Steve <steve@designerwallcoverings.com>
Date:   Tue May 19 09:07:34 2026 -0700

    Wizard: listen on both IPv4 and IPv6 loopback so localhost resolves
---
 server.js | 17 ++++++++++++-----
 1 file changed, 12 insertions(+), 5 deletions(-)

diff --git a/server.js b/server.js
index 0cbf48e..ee1acda 100644
--- a/server.js
+++ b/server.js
@@ -88,7 +88,7 @@ function send(res, code, type, body) {
   res.end(body);
 }
 
-const server = http.createServer(async (req, res) => {
+const requestHandler = async (req, res) => {
   if (req.method === 'GET' && (req.url === '/' || req.url === '/index.html')) {
     return send(res, 200, 'text/html; charset=utf-8', PAGE);
   }
@@ -115,11 +115,18 @@ const server = http.createServer(async (req, res) => {
     return;
   }
   send(res, 404, 'text/plain', 'not found');
-});
+};
 
-server.listen(PORT, '127.0.0.1', () => {
-  console.log('ig-token-wizard → http://127.0.0.1:' + PORT + '  (localhost only)');
-});
+// Listen on BOTH loopback addresses — IPv4 127.0.0.1 and IPv6 ::1 — so the
+// wizard is reachable whether the browser resolves "localhost" to v4 or v6.
+// Both are loopback-only; the wizard handles Meta secrets and is never
+// exposed to the LAN.
+for (const host of ['127.0.0.1', '::1']) {
+  http.createServer(requestHandler).listen(PORT, host, () => {
+    const shown = host.includes(':') ? '[' + host + ']' : host;
+    console.log('ig-token-wizard → http://' + shown + ':' + PORT);
+  });
+}
 
 // ── The page ───────────────────────────────────────────────────────────────
 const PAGE = `<!doctype html><html lang="en"><head>

← fd6e741 Instagram token wizard — short-lived Meta token to IG creds · back to Ig Token Wizard · Add Continue-with-Facebook OAuth flow — paste 2 values, clic 6f0ed4a →