Pelican: Pelican binds to 0.0.0.0 instead of 127.0.0.1 when --bind is omitted

[rpmzandwijk]

Problem

When starting Pelican like
$ pelican --listen

it binds to all network interfaces. However:

$ pelican --help
...
  -b BIND, --bind BIND  IP to bind to when serving files via HTTP (default:
                        127.0.0.1) (default: None)

When ommiting --bind, it should bind to 127.0.0.1 only.

Observation

My macOS machine presents a pop-up with the question if I want to allow '_The application "Python.app" to accept incoming network connections?_'. Typically, macOS only asks this question if a service is being bound to a public network interface and not the loop back interface.

After clicking allow, a netstat shows Pelican is bound to all available interfaces (note: one should first visit the site on the IP number of the public network interface, otherwise netstat won't show this):

$ netstat -an|grep '*.8000'
tcp4       0      0  *.8000                 *.*                    LISTEN

Cause

When pelican is started with --listen, but --bind is ommited, default settings from pelican/settings.py are used. In the DEFAULT_CONFIG dictionary, we find: 'BIND': '',

BIND is then passed to listen(), RootedHTTPServer(), BaseHTTPServer() and finally to socket()

The socket documentation states:

For IPv4 addresses, two special forms are accepted instead of a host address: '' represents INADDR_ANY, which is used to bind to all interfaces, and the string '' represents INADDR_BROADCAST.

Thus, because the default setting of BIND is '', Pelican is bound to all interfaces and not, as documented and promised, 127.0.0.1 only.

Solution

The solution is to set BIND to '127.0.0.1' in pelican/settings.py. As a workaround, it is also possible to set BIND = '127.0.0.1' in pelicanconf.py

[justinmayer]

While the documentation could be changed to reflect the current actual effective default of 0.0.0.0 (all interfaces), I agree it makes more sense from a security perspective to default to localhost. Do other @getpelican/reviewers agree?

If so, would anyone care to volunteer and implement a fix for this issue?

[apoos-maximus]

i m working on it

[justinmayer]

Thanks to @andreagrandi, the fix for this is included in the just-released Pelican v4.1.3, courtesy of AutoPub.