Summary

Streamlit binds per default to *:8501 and :::8501. The only protection it uses is CORS.

Steps to reproduce

What are the steps we should take to reproduce the bug:

1. Set browser.serverAddress to 127.0.0.1
2. $ streamlit hello
3. $ ss -tulpn | grep stream

Expected behaviour:

The program should bind to the specified IP Address. The option browser.Address should bind Streamlit to the defined IP Address and not to all interfaces.

Actual behaviour:

After the start of the program it show:
You can now view your Streamlit app in your browser.
URL: http://127.0.0.1:8501

tcp    LISTEN     0      128                    *:8501                  *:*      users:(("streamlit",pid=11111,fd=6))
tcp    LISTEN     0      128                   :::8501                 :::*      users:(("streamlit",pid=11111,fd=7))

Debug info

• Streamlit version: Streamlit, version 0.49.0
• Python version: Python 2.7.9
• virtualenv
• OS version: Debian GNU/Linux 8 (Jessie)

If needed I can provide all installed python libraries.

Corresponding Code

lib/streamlit/server/Server: Line 121

try:
     app.listen(port)
     break

If wanted I would add an Option to configure the ListenAddress.