-
-
Notifications
You must be signed in to change notification settings - Fork 8k
Description
Describe the bug
As of v17, node respects the order of IP addresses returned by the system resolver.
This means localhost might resolve to 127.0.0.1 in a system and ::1 in another. As vite defaults to 127.0.0.1 and even translates localhost to it since #2977, it means starting up a vite server without a configured host (or with --host localhost) and doing net.connect(port) or net.connect(port, 'localhost') can fail.
I believe this could be fixed by defaulting to 'localhost' instead of the ipv4 here, but I'm unsure if that has negative complications:
vite/packages/vite/src/node/utils.ts
Lines 587 to 594 in 33f9671
| if ( | |
| optionsHost === undefined || | |
| optionsHost === false || | |
| optionsHost === 'localhost' | |
| ) { | |
| // Use a secure default | |
| host = '127.0.0.1' | |
| } else if (optionsHost === true) { |
Why was localhost considered insecure? A system might even have reasons to have it resolved to a different, local interface—however unconventional that might be.
If there are no objections, I can open a PR with that change.
Reproduction
I'm not sure how to create a reproduction; I'd have to patch node's dns resolution.
System Info
n/aUsed Package Manager
pnpm
Logs
No response
Validations
- Follow our Code of Conduct
- Read the Contributing Guidelines.
- Read the docs.
- Check that there isn't already an issue that reports the same bug to avoid creating a duplicate.
- Make sure this is a Vite issue and not a framework-specific issue. For example, if it's a Vue SFC related bug, it should likely be reported to https://github.com/vuejs/core instead.
- Check that this is a concrete bug. For Q&A open a GitHub Discussion or join our Discord Chat Server.
- The provided reproduction is a minimal reproducible example of the bug.