Skip to content

Add address binding for improved security #4

@sanzoghenzo

Description

@sanzoghenzo

As of now, it is possible to only change the server listening port with the PYREVT_TELEMETRY_PORT environment variable or --port cli flag.

To avoid unwanted access from anywhere, it is a good practice for services to allow the setup of address binding, which often defaults to 127.0.0.1 (only same-machine traffic), even though it is a bit extreme.

While we could live the default as it is (everybody can reach the server), adding the option to restrict the traffic to a specific interface/IP pool would be a good addition.

If I understood correcly, http.ListenAndServe[TLS] already can accept the bind address as part of the first argument, so it is just a matter of adding a new flag/environment variable and add it to the fmt.Sprintf (server/server.go lines 39 and 47).

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions