make our backend accessible only from where its running

2025-07-29 13:53:57 +02:00
parent 7f09c9d334
commit ba1ac50c16
1 changed files with 2 additions and 1 deletions
--- a/src/auracast/server/multicast_server.py
+++ b/src/auracast/server/multicast_server.py
@@ -417,4 +417,5 @@ if __name__ == '__main__':
        level=os.environ.get('LOG_LEVEL', log.INFO),
        format='%(module)s.py:%(lineno)d %(levelname)s: %(message)s'
    )
-    uvicorn.run(app, host="0.0.0.0", port=5000)
+    # Bind to localhost only for security: prevents network access, only frontend on same machine can connect
+    uvicorn.run(app, host="127.0.0.1", port=5000)