Description
The CLI's server command starts listening without an address, so Node binds it to every network interface. The site is then reachable from the whole local network, and there is no way to ask for localhost only — runCLI() accepts db-host, but no host.
On Windows this also raises a firewall prompt on every start ("Do you want to allow public and private networks to access this app?"), and allowing it is what actually opens the site to the LAN. On macOS and Linux the same binding happens silently.
It matters most in the case Playground is best at: a throwaway development site running with well-known admin credentials, on shared conference or coworking wifi.
Proposal
- Bind the server to
127.0.0.1 by default.
- Add a
host option — CLI flag and runCLI argument — for the cases where reaching the site from another device is the point: testing on a phone, a VM, or a colleague's machine.
Loopback by default with an explicit opt-in to share is what most local dev servers do, and it makes exposing the site a decision rather than a side effect.
Notes
Tools that embed runCLI can work around this by patching Node's listen before the CLI is loaded, which is what WordPress/experimental-wp-dev-env#59 ended up doing. It works, but a host option would make it unnecessary.
Description
The CLI's
servercommand starts listening without an address, so Node binds it to every network interface. The site is then reachable from the whole local network, and there is no way to ask for localhost only —runCLI()acceptsdb-host, but nohost.On Windows this also raises a firewall prompt on every start ("Do you want to allow public and private networks to access this app?"), and allowing it is what actually opens the site to the LAN. On macOS and Linux the same binding happens silently.
It matters most in the case Playground is best at: a throwaway development site running with well-known admin credentials, on shared conference or coworking wifi.
Proposal
127.0.0.1by default.hostoption — CLI flag andrunCLIargument — for the cases where reaching the site from another device is the point: testing on a phone, a VM, or a colleague's machine.Loopback by default with an explicit opt-in to share is what most local dev servers do, and it makes exposing the site a decision rather than a side effect.
Notes
Tools that embed
runCLIcan work around this by patching Node'slistenbefore the CLI is loaded, which is what WordPress/experimental-wp-dev-env#59 ended up doing. It works, but ahostoption would make it unnecessary.