fix(gateway): warn on non-loopback bind at startup (land #25397, thanks @let5sne)

Co-authored-by: let5sne <let5sne@users.noreply.github.com>
This commit is contained in:
Peter Steinberger
2026-02-26 12:11:12 +00:00
parent 327f0526d1
commit a288f3066f
2 changed files with 8 additions and 1 deletions

View File

@@ -11,7 +11,7 @@ import type { ResolvedGatewayAuth } from "./auth.js";
import type { ChatAbortControllerEntry } from "./chat-abort.js";
import type { ControlUiRootState } from "./control-ui.js";
import type { HooksConfigResolved } from "./hooks.js";
import { resolveGatewayListenHosts } from "./net.js";
import { isLoopbackHost, resolveGatewayListenHosts } from "./net.js";
import {
createGatewayBroadcaster,
type GatewayBroadcastFn,
@@ -117,6 +117,12 @@ export async function createGatewayRuntimeState(params: {
});
const bindHosts = await resolveGatewayListenHosts(params.bindHost);
if (!isLoopbackHost(params.bindHost)) {
params.log.warn(
"⚠️ Gateway is binding to a non-loopback address. " +
"Ensure authentication is configured before exposing to public networks.",
);
}
const httpServers: HttpServer[] = [];
const httpBindHosts: string[] = [];
for (const host of bindHosts) {