security: bind server to 127.0.0.1 so the tunnel/proxy basic-auth gate can't be bypassed on the LAN

e5b882411b24eaf1d7d2b69a5e691385f963fd79 · 2026-07-16 07:51:19 -0700 · Steve

Files touched

M server.js

Diff

commit e5b882411b24eaf1d7d2b69a5e691385f963fd79
Author: Steve <steve@designerwallcoverings.com>
Date:   Thu Jul 16 07:51:19 2026 -0700

    security: bind server to 127.0.0.1 so the tunnel/proxy basic-auth gate can't be bypassed on the LAN
---
 server.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/server.js b/server.js
index a770b42..ab320de 100644
--- a/server.js
+++ b/server.js
@@ -303,7 +303,7 @@ const server = http.createServer(async (req, res) => {
   res.end('not found');
 });
 
-server.listen(PORT, () => {
+server.listen(PORT, '127.0.0.1', () => {
   console.log(`[trade-portal] http://localhost:${server.address().port}`);
   console.log(`  Demo trade login: trade@demo.com / trade2024`);
   console.log(`  Admin: /admin${ADMIN_AUTH ? ' (BASIC_AUTH set)' : ' (open — set BASIC_AUTH=user:pass to gate)'}`);

← 7904fa5 Add Buy on Shopify cart button, test-mode banner, trade pric · back to Trade Portal · auto-save: 2026-07-16T08:12:03 (1 files) — data/shopify-cata a0835ac →