MagicMirrorOrg/MagicMirror · warning
You're using a full whitelist configuration to allow for all
Error message
You're using a full whitelist configuration to allow for all IPs
What it means
When config.ipWhitelist is an empty array, the ipAccessControl middleware allows every address. MagicMirror explicitly warns that the server will accept requests from all IPs, since this is almost always a misconfiguration made to 'just get it working'.
Source
Thrown at js/server.js:88
` PORT IN USE: ${bindAddr}:${port}`,
"",
" Another process (most likely another MagicMirror instance)",
" is already using this port.",
"",
" Stop the other process (free the port) or use a different port.",
"────────────────────────────────────────────────────────────────"
].join("\n");
Log.error(portInUseMessage);
return;
}
Log.error("Failed to start server:", err);
});
server.listen(port, config.address || "localhost");
if (config.ipWhitelist instanceof Array && config.ipWhitelist.length === 0) {
Log.warn("You're using a full whitelist configuration to allow for all IPs");
}
app.use(ipAccessControl(config.ipWhitelist));
app.use(helmet(config.httpHeaders));
app.use("/js", express.static(__dirname));
if (config.hideConfigSecrets) {
app.get("/config/config.env", (req, res) => {
res.status(404).send("<!DOCTYPE html>\n<html lang=\"en\">\n<head>\n<meta charset=\"utf-8\">\n<title>Error</title>\n</head>\n<body>\n<pre>Cannot GET /config/config.env</pre>\n</body>\n</html>");
});
}
let directories = ["/config", "/css", "/favicon.svg", "/defaultmodules", "/modules", "/node_modules/animate.css", "/node_modules/@fontsource", "/node_modules/@fortawesome", "/node_modules/suncalc", "/translations", "/tests/configs", "/tests/mocks"];
for (const value of Object.values(vendor)) {
const dirArr = value.split("/");
if (dirArr[0] === "node_modules") directories.push(`/${dirArr[0]}/${dirArr[1]}`);
}
const uniqDirs = [...new Set(directories)];View on GitHub (pinned to 4b4a59534f)
Solutions
- Replace the empty array with explicit CIDR entries covering your network, e.g. ["127.0.0.1", "::ffff:127.0.0.1", "::1", "192.168.1.0/24"].
- If the whole LAN should connect, add the LAN subnet rather than allowing all IPs.
- If you intentionally want all IPs, leave as-is but pair it with authentication or a reverse proxy/firewall.
Example fix
// before ipWhitelist: [] // after ipWhitelist: ["127.0.0.1", "::ffff:127.0.0.1", "::1", "192.168.1.0/24"]
Defensive patterns
Strategy: validation
Validate before calling
// validate ipWhitelist in a config pre-check:
const wl = config.ipWhitelist;
if (Array.isArray(wl) && wl.length === 0) {
throw new Error("ipWhitelist is empty: server accepts ALL IPs");
} Prevention
- Never commit config.js with ipWhitelist: []
- Add your LAN subnet explicitly instead of clearing the list
- Review config.js after copy-pasting from tutorials
- Use `npm run config:check` before starting the server
When it happens
Trigger: Setting `ipWhitelist: []` in config.js, or expanding the previous default whitelist entries into an empty list while trying to make other devices reach the mirror.
Common situations: Accessing the mirror from a phone or another LAN device and emptying the whitelist instead of adding the specific address; container/VM setups where the real client IP differs from localhost.
Related errors
- HTTP ${response.status}
- Failed to fetch grid point: HTTP ${pointsResponse.status}
- Failed to fetch observation stations: HTTP ${stationsRespons
- This device is not allowed to access your mirror. <br> Pleas
- <!DOCTYPE html> <html lang="en"> <head> <meta charset="utf-8
AI-assisted analysis of MagicMirrorOrg/MagicMirror@4b4a59534f (2026-08-31).
Data as JSON: /api/errors/f9027916d2b45e4b.
Report an issue: GitHub.