{"record":{"id":"f9027916d2b45e4b","repo":"MagicMirrorOrg/MagicMirror","slug":"you-re-using-a-full-whitelist-configuration-to-all","errorCode":null,"errorMessage":"You're using a full whitelist configuration to allow for all IPs","messagePattern":"You're using a full whitelist configuration to allow for all IPs","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"js/server.js","lineNumber":88,"sourceCode":"\t\t\t\t\t\t` PORT IN USE: ${bindAddr}:${port}`,\n\t\t\t\t\t\t\"\",\n\t\t\t\t\t\t\" Another process (most likely another MagicMirror instance)\",\n\t\t\t\t\t\t\" is already using this port.\",\n\t\t\t\t\t\t\"\",\n\t\t\t\t\t\t\" Stop the other process (free the port) or use a different port.\",\n\t\t\t\t\t\t\"────────────────────────────────────────────────────────────────\"\n\t\t\t\t\t].join(\"\\n\");\n\t\t\t\t\tLog.error(portInUseMessage);\n\t\t\t\t\treturn;\n\t\t\t\t}\n\n\t\t\t\tLog.error(\"Failed to start server:\", err);\n\t\t\t});\n\n\t\t\tserver.listen(port, config.address || \"localhost\");\n\n\t\t\tif (config.ipWhitelist instanceof Array && config.ipWhitelist.length === 0) {\n\t\t\t\tLog.warn(\"You're using a full whitelist configuration to allow for all IPs\");\n\t\t\t}\n\n\t\t\tapp.use(ipAccessControl(config.ipWhitelist));\n\t\t\tapp.use(helmet(config.httpHeaders));\n\t\t\tapp.use(\"/js\", express.static(__dirname));\n\n\t\t\tif (config.hideConfigSecrets) {\n\t\t\t\tapp.get(\"/config/config.env\", (req, res) => {\n\t\t\t\t\tres.status(404).send(\"\\n\\n\\n\\nError\\n\\n\\nCannot GET /config/config.env
\\n\\n\");\n\t\t\t\t});\n\t\t\t}\n\n\t\t\tlet directories = [\"/config\", \"/css\", \"/favicon.svg\", \"/defaultmodules\", \"/modules\", \"/node_modules/animate.css\", \"/node_modules/@fontsource\", \"/node_modules/@fortawesome\", \"/node_modules/suncalc\", \"/translations\", \"/tests/configs\", \"/tests/mocks\"];\n\t\t\tfor (const value of Object.values(vendor)) {\n\t\t\t\tconst dirArr = value.split(\"/\");\n\t\t\t\tif (dirArr[0] === \"node_modules\") directories.push(`/${dirArr[0]}/${dirArr[1]}`);\n\t\t\t}\n\t\t\tconst uniqDirs = [...new Set(directories)];","sourceCodeStart":70,"sourceCodeEnd":106,"githubUrl":"https://github.com/MagicMirrorOrg/MagicMirror/blob/4b4a59534f7da01e4030e46029fe9dd649a7675e/js/server.js#L70-L106","documentation":"When config.ipWhitelist is an empty array, the ipAccessControl middleware allows every address. MagicMirror explicitly warns that the server will accept requests from all IPs, since this is almost always a misconfiguration made to 'just get it working'.","triggerScenarios":"Setting `ipWhitelist: []` in config.js, or expanding the previous default whitelist entries into an empty list while trying to make other devices reach the mirror.","commonSituations":"Accessing the mirror from a phone or another LAN device and emptying the whitelist instead of adding the specific address; container/VM setups where the real client IP differs from localhost.","solutions":["Replace the empty array with explicit CIDR entries covering your network, e.g. [\"127.0.0.1\", \"::ffff:127.0.0.1\", \"::1\", \"192.168.1.0/24\"].","If the whole LAN should connect, add the LAN subnet rather than allowing all IPs.","If you intentionally want all IPs, leave as-is but pair it with authentication or a reverse proxy/firewall."],"exampleFix":"// before\nipWhitelist: []\n// after\nipWhitelist: [\"127.0.0.1\", \"::ffff:127.0.0.1\", \"::1\", \"192.168.1.0/24\"]","handlingStrategy":"validation","validationCode":"// validate ipWhitelist in a config pre-check:\nconst wl = config.ipWhitelist;\nif (Array.isArray(wl) && wl.length === 0) {\n throw new Error(\"ipWhitelist is empty: server accepts ALL IPs\");\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Never commit config.js with ipWhitelist: []","Add your LAN subnet explicitly instead of clearing the list","Review config.js after copy-pasting from tutorials","Use `npm run config:check` before starting the server"],"tags":["security","network","ip-whitelist"],"backgroundTag":"ip-whitelist-open-to-all","analyzedSha":"4b4a59534f7da01e4030e46029fe9dd649a7675e","analyzedAt":"2026-08-31T21:49:42.591Z","schemaVersion":2},"datasetVersion":"2026-08-31T22:30:34.772Z"}