[PR #109] [MERGED] fix: default API to localhost #213

New issue

Closed

opened 2026-02-28 14:26:16 +03:00 by kerem · 0 comments

kerem commented

2026-02-28 14:26:16 +03:00

Owner

📋 Pull Request Information

Original PR: https://github.com/devgianlu/go-librespot/pull/109
Author: @aykevl
Created: 10/1/2024
Status: ✅ Merged
Merged: 10/2/2024
Merged by: @devgianlu

Base: master ← Head: fix-api-localhost

📝 Commits (1)

30418ba fix: default API to localhost

📊 Changes

3 files changed (+3 additions, -1 deletions)

View changed files

📝 README.md (+1 -0)
📝 cmd/daemon/main.go (+1 -0)
📝 config_schema.json (+1 -1)

📄 Description

The previous default was to bind to 0.0.0.0 and allow connections from anywhere. I think this is an insecure default, the default should be restricted.

To restore the previous behavior, use:

server:
  address: ""

For example, I'm using the API from Home Assistant running on the same Raspberry Pi. There is no reason for the API to be exposed on my local network. And generally it's a good idea to have safe default values (and require users to opt-in to less safe options).

(Not sure whether this counts as a fix or a feature, but I guess it fixes potential unsafe configurations, so...)

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/devgianlu/go-librespot/pull/109 **Author:** [@aykevl](https://github.com/aykevl) **Created:** 10/1/2024 **Status:** ✅ Merged **Merged:** 10/2/2024 **Merged by:** [@devgianlu](https://github.com/devgianlu) **Base:** `master` ← **Head:** `fix-api-localhost` --- ### 📝 Commits (1) - [`30418ba`](https://github.com/devgianlu/go-librespot/commit/30418bab43e5dd844ae70e399c34c21ae2c3c994) fix: default API to localhost ### 📊 Changes **3 files changed** (+3 additions, -1 deletions) <details> <summary>View changed files</summary> 📝 `README.md` (+1 -0) 📝 `cmd/daemon/main.go` (+1 -0) 📝 `config_schema.json` (+1 -1) </details> ### 📄 Description The previous default was to bind to 0.0.0.0 and allow connections from anywhere. I think this is an insecure default, the default should be restricted. To restore the previous behavior, use: ```yaml server: address: "" ``` For example, I'm using the API from Home Assistant running on the same Raspberry Pi. There is no reason for the API to be exposed on my local network. And generally it's a good idea to have safe default values (and require users to opt-in to less safe options). (Not sure whether this counts as a fix or a feature, but I guess it fixes potential unsafe configurations, so...) --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>