What causes "IP ${clientIp} is not allowed to connect to the mirror socket" in MagicMirrorOrg/MagicMirror?

Add the client IP/subnet to ipWhitelist in config.js and restart the server.

IP ${clientIp} is not allowed to connect to the mirror socke

Error message

IP ${clientIp} is not allowed to connect to the mirror socket

What it means

socketIpAccessControl builds an allowRequest function for Socket.IO that resolves and validates the connecting client's IP. When the IP is not in the whitelist, it logs this warning and rejects the handshake by invoking callback with an error string ('This device is not allowed to access your mirror.'), preventing the socket connection.

Source

Thrown at js/ip_access_control.js:103

 * Creates a Socket.IO `allowRequest` handler that enforces the same IP whitelist as the HTTP middleware.
 * This closes the gap where Socket.IO handshakes bypassed the Express-only `ipAccessControl` middleware.
 * @param {string[]} whitelist - Array of allowed IP addresses or CIDR ranges
 * @returns {(req: object, callback: (err: string | null, success: boolean) => void) => void} Socket.IO allowRequest handler
 */
function socketIpAccessControl (whitelist) {
	// Empty whitelist means allow all
	if (!Array.isArray(whitelist) || whitelist.length === 0) {
		return function (req, callback) {
			callback(null, true); // allow the connection
		};
	}

	return function (req, callback) {
		const clientIp = resolveClientIp(req);
		if (isAllowed(clientIp, whitelist)) {
			callback(null, true); // allow the connection
		} else {
			Log.warn(`IP ${clientIp} is not allowed to connect to the mirror socket`);
			callback("This device is not allowed to access your mirror.", false);
		}
	};
}

module.exports = { ipAccessControl, socketIpAccessControl };

View on GitHub (pinned to 4b4a59534f)

Solutions

Add the client IP/subnet to ipWhitelist in config.js and restart the server.
Use ipWhitelist: [] to permit all connections on trusted networks.
Check the logged client IP — with proxies it may be the proxy's address; fix X-Forwarded-For resolution.
Ensure the same whitelist logic applies to both HTTP and socket paths (both read the same config; a mismatch means stale config).

Example fix

// before (config.js)
ipWhitelist: ["127.0.0.1", "::1"]  // phone on LAN rejected
// after
ipWhitelist: ["127.0.0.1", "::1", "192.168.0.0/16"]

Defensive patterns

Strategy: validation

Validate before calling

// Validate socket-level access expectations at startup
const ipaddr = require("ipaddr.js");
function assertWhitelistUsable(list) {
  if (list.length === 0) return; // allow-all mode
  list.forEach(e => { try { ipaddr.process(e); } catch { throw new Error(`Invalid ipWhitelist entry: ${e}`); } });
  if (list.every(e => ipaddr.process(e).range() === "loopback")) {
    console.warn("Whitelist is loopback-only; remote Socket.IO clients will be rejected.");
  }
}

Type guard

function socketClientAllowed(req, whitelist) {
  const ip = resolveClientIp(req);
  if (whitelist.length === 0) return true;
  try { const addr = ipaddr.process(ip); return whitelist.some(e => { try { return addr.match(ipaddr.parseCIDR(e)) || addr.toString() === ipaddr.process(e).toString(); } catch { return false; } }); }
  catch { return false; }
}

Try / catch

io.use((socket, next) => {
  const ip = resolveClientIp(socket.request);
  if (isAllowed(ip, whitelist)) next();
  else next(new Error(`IP ${ip} is not allowed to connect to the mirror socket`));
});

Prevention

Mirror your HTTP ipWhitelist and socket whitelist from the same config value so both layers agree.
Restart the server after changing ipWhitelist — the handshake check is evaluated per connection with the loaded config.
Check the warned IP against what you whitelisted; Docker/IPv6-mapped forms (::ffff:) frequently mismatch.
On trusted LANs, set ipWhitelist: [] to eliminate both 403s and socket rejections.

When it happens

Trigger: A Socket.IO client (the mirror's browser UI) attempts to connect while its resolved IP is outside the configured ipWhitelist; the handshake is rejected before any socket communication starts.

Common situations: Same causes as the HTTP 403 case but surfacing on the socket layer: browsing from another LAN device with the default localhost-only whitelist; Docker/IPv6 address mismatch; whitelist edited but server not restarted, or HTTP allowed while socket check uses a different resolved IP.

Related errors

AI-assisted analysis of MagicMirrorOrg/MagicMirror@4b4a59534f (2026-08-31). Data as JSON: /api/errors/8bd4f3c2c7d19619. Report an issue: GitHub.