Skip to content

Add address binding for improved security #4

@sanzoghenzo

Description

@sanzoghenzo

As of now, it is possible to only change the server listening port with the PYREVT_TELEMETRY_PORT environment variable or --port cli flag.

To avoid unwanted access from anywhere, it is a good practice for services to allow the setup of address binding, which often defaults to 127.0.0.1 (only same-machine traffic), even though it is a bit extreme.

While we could live the default as it is (everybody can reach the server), adding the option to restrict the traffic to a specific interface/IP pool would be a good addition.

If I understood correcly, http.ListenAndServe[TLS] already can accept the bind address as part of the first argument, so it is just a matter of adding a new flag/environment variable and add it to the fmt.Sprintf (server/server.go lines 39 and 47).

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions