fix(server): Security fix: only listen to private network address by default #2865

eirslett · 2021-04-05T22:28:47Z

See also #2820 which makes this problem critically worse.

Up until now, Vite has been listening on all public IP addresses
by default, which could be a potential security vulnerability.

This fixes the default behavior, so Vite only listens on 127.0.0.1.

You can get the old behavior back (listen to all IPs) by running
with the --listen-public CLI flag, or setting

export default defineConfig({
  server: {
    listenPublic: true
  }
  // ... more config here
})

in the Vite config file.

This is how the two alternatives look like in the terminal: You can see that it writes "(disabled)" next to the public IP.

furudean · 2021-04-05T22:43:32Z

How about we just render the message stating its disabled instead of showing the address? It can't be accessed after all. This avoids some unnecessary information shown to the user.

Something like:

local:    http://localhost:3000
network:  (disabled)

Additionally we could hint toward how to open the gates to the network:

Use --host to expose server to other devices on this network

antfu · 2021-04-06T00:11:04Z

Instead of the "listenPublic" options, maybe it's more straightforward to let users use host.

eirslett · 2021-04-06T00:48:53Z

Instead of the "listenPublic" options, maybe it's more straightforward to let users use host.

Yes, that's more straightforward, at least a bit easier from an implementation perspective inside Vite. And after all, the host option is already there today. However, considering the user-friendliness/developer experience, aren't people more likely to understand the meaning of public/private IP vs. how configuring the host parameter will affect the end result?

But even though using host could be more confusing for some (that's what I would imagine, at least), it can be compensated for with @c-bandy 's suggestion of providing hints in the console output.

I'm fine with both versions. WDYT?

liuweiGL · 2021-04-06T01:13:56Z

I recommend using the listen property:

server: {
  listen: ip, // 127.0.0.1 or 0.0.0.0 or 192.168.35.1/24
}

patak-dev · 2021-04-06T07:19:09Z

Thanks for pushing for this change @eirslett. IMO, we shouldn't show the Network line at all. If we want to hint that there is a config option to enable this, maybe we can add a line about that Use --public-ip to enable public network access (at least for a while in case someone was using this feature, but maybe it is enough if this is properly documented)

packages/vite/src/node/cli.ts

packages/vite/src/node/server/index.ts

Shinigami92 · 2021-04-06T19:08:06Z

Some tests are failing on AppVeyor 🤔
We may to find out why and possibly fix them before I can set my approval

eirslett · 2021-04-06T21:17:14Z

Some tests are failing on AppVeyor 🤔
We may to find out why and possibly fix them before I can set my approval

I suspect that the test is trying to connect to localhost, but to the public IP interface instead of the private one...?
If the difference between AppVeyor and CircleCI is Windows vs Unix, then somebody with a Windows machine should probably test the change manually?

eirslett · 2021-04-10T11:56:41Z

ping is there anybody with a Windows setup who can test locally that this change does what it's supposed to? I think the AppVeyor build fails because of the OS, but I'm not sure.

Shinigami92 · 2021-04-10T12:03:15Z

We may rebase this PR when #2622 was merged into main
Then there is a os:windows runner

With that we can then see if it's a windows problem or not

Shinigami92 · 2021-04-10T12:37:37Z

@eirslett You can do that now! #2622 is merged 🙂

…default See also vitejs#2820 which makes this problem critically worse. Up until now, Vite has been listening on all public IP addresses by default, which could be a potential security vulnerability. This fixes the default behavior, so Vite only listens on 127.0.0.1. You can get the old behavior back (listen to all IPs) by running with the --listen-public CLI flag, or setting ``` export default defineConfig({ server: { listenPublic: true } // ... more config here }) ``` in the Vite config file.

Co-authored-by: Shinigami <chrissi92@hotmail.de>

eirslett · 2021-04-12T14:59:59Z

Looks like it's failing all over the place... on my MacOS locally, the tests pass. 😩

dominikg · 2021-04-12T18:20:25Z

packages/vite/src/node/server/index.ts

@@ -555,7 +562,10 @@ async function startServer(

    httpServer.on('error', onError)

-    httpServer.listen(port, options.host, () => {
+    const listenHostname = listenPublic


would this mean you'd have to specify listenPublic: true if you want to set a custom hostname?

Correct - you would have to explicitly set both.

hmm, not sure i like that. If i'm actively setting host it should work without having to set another option too. Imho defaulting host to 127.0.0.1 should suffice. Users can still do --host 0.0.0.0 to get the old behavior back. (they shouldn't).

not to mention that listenPublic may be a misnomer. We don't know the network setup on the machine the devserver is running on. The only safe assumption is that 127.0.0.1 isn't "public".

I also think that if a user specifies a --host, it is already opting in.

As @c-bandy was proposing, we should add a message in the console to let the user know this option

Use --host to expose the server to other devices on this network

I think we should implement the same scheme as sirv: https://github.com/lukeed/sirv/tree/master/packages/sirv-cli#network-access

For security reasons, sirv-cli does not expose your server to the network by default. This means that your machine, and only your machine, will be able to access the localhost server.
If, however, your coworker wants to access the server from their computer, or you want to preview your work on a mobile device, you must use the --host flag. Only then will your server be accessible to other devices on the same network.
Using --host without a value is equivalent to --host 0.0.0.0, which is makes it discoverable publicly. You may customize this by passing a different value – but you probably don't need to!

@antfu what do you think? I like the --host option without parameters scheme here for the old behavior. And we wouldn't need an extra option

eirslett · 2021-04-13T21:36:46Z

I created a new PR that implements this, but uses only the --host parameter: #2977
Looks like most people wanted that solution, so I'll close this PR for now.

antfu added p4-important Violate documented behavior or significantly improves performance (priority) security labels Apr 6, 2021

Shinigami92 reviewed Apr 6, 2021

View reviewed changes

packages/vite/src/node/cli.ts Outdated Show resolved Hide resolved

packages/vite/src/node/server/index.ts Outdated Show resolved Hide resolved

eirslett and others added 4 commits April 12, 2021 16:25

fix(test): playwright should connect to local IP interface

fe4f6c0

Update packages/vite/src/node/server/index.ts

41fef5d

Co-authored-by: Shinigami <chrissi92@hotmail.de>

no blank line needed

3fa2971

Co-authored-by: Shinigami <chrissi92@hotmail.de>

eirslett force-pushed the listen-only-private-ip-by-default branch from 470f4f2 to 3fa2971 Compare April 12, 2021 14:25

dominikg reviewed Apr 12, 2021

View reviewed changes

eirslett mentioned this pull request Apr 13, 2021

fix(server): Listen only to 127.0.0.1 by default #2977

Merged

eirslett closed this Apr 13, 2021

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix(server): Security fix: only listen to private network address by default #2865

fix(server): Security fix: only listen to private network address by default #2865

eirslett commented Apr 5, 2021 •

edited

Loading

furudean commented Apr 5, 2021

antfu commented Apr 6, 2021

eirslett commented Apr 6, 2021

liuweiGL commented Apr 6, 2021

patak-dev commented Apr 6, 2021

Shinigami92 commented Apr 6, 2021

eirslett commented Apr 6, 2021

eirslett commented Apr 10, 2021

Shinigami92 commented Apr 10, 2021

Shinigami92 commented Apr 10, 2021

eirslett commented Apr 12, 2021

dominikg Apr 12, 2021

eirslett Apr 12, 2021

dominikg Apr 12, 2021 •

edited

Loading

dominikg Apr 12, 2021

patak-dev Apr 12, 2021 •

edited

Loading

eirslett commented Apr 13, 2021

fix(server): Security fix: only listen to private network address by default #2865

fix(server): Security fix: only listen to private network address by default #2865

Conversation

eirslett commented Apr 5, 2021 • edited Loading

furudean commented Apr 5, 2021

antfu commented Apr 6, 2021

eirslett commented Apr 6, 2021

liuweiGL commented Apr 6, 2021

patak-dev commented Apr 6, 2021

Shinigami92 commented Apr 6, 2021

eirslett commented Apr 6, 2021

eirslett commented Apr 10, 2021

Shinigami92 commented Apr 10, 2021

Shinigami92 commented Apr 10, 2021

eirslett commented Apr 12, 2021

dominikg Apr 12, 2021

Choose a reason for hiding this comment

eirslett Apr 12, 2021

Choose a reason for hiding this comment

dominikg Apr 12, 2021 • edited Loading

Choose a reason for hiding this comment

dominikg Apr 12, 2021

Choose a reason for hiding this comment

patak-dev Apr 12, 2021 • edited Loading

Choose a reason for hiding this comment

eirslett commented Apr 13, 2021

eirslett commented Apr 5, 2021 •

edited

Loading

dominikg Apr 12, 2021 •

edited

Loading

patak-dev Apr 12, 2021 •

edited

Loading