{"record":{"id":"fb8f1514ffa9c941","repo":"abhigyanpatwari/GitNexus","slug":"gitnexus-serve-bound-to-a-wildcard-address-bo","errorCode":null,"errorMessage":"[gitnexus serve] Bound to a wildcard address (${boundHost}); browser write routes ${admitted}","messagePattern":"\\[gitnexus serve\\] Bound to a wildcard address \\((.+?)\\); browser write routes (.+?)","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"gitnexus/src/server/middleware.ts","lineNumber":288,"sourceCode":"      { [PUBLIC_ORIGIN_ENV]: raw, hostname: publicOrigin.hostname },\n      `[gitnexus serve] Browser write routes also accept origins on ${publicOrigin.hostname}.`,\n    );\n  } else if (raw) {\n    logger.warn(\n      { [PUBLIC_ORIGIN_ENV]: raw },\n      `[gitnexus serve] Ignoring ${PUBLIC_ORIGIN_ENV}=${raw} — not a single reachable origin, ` +\n        `so it admits nothing. Set it to one host, optionally with a scheme and a port.`,\n    );\n  }\n\n  if (!boundHost || normalizeBoundHost(boundHost) !== undefined) return;\n  const admitted = publicOrigin\n    ? `accept loopback origins (localhost/127.0.0.1/[::1]) and ${publicOrigin.hostname} via ` +\n      `${PUBLIC_ORIGIN_ENV}.`\n    : `accept only loopback origins (localhost/127.0.0.1/[::1]). To admit writes from a specific ` +\n      `LAN address, bind --host <that-address> instead of a wildcard; to admit them from a ` +\n      `public origin, set ${PUBLIC_ORIGIN_ENV} to it.`;\n  logger.warn(\n    { host: boundHost },\n    `[gitnexus serve] Bound to a wildcard address (${boundHost}); browser write routes ${admitted}`,\n  );\n}\n\n/** Loopback + RFC1918 + link-local: the hops a self-hosted install sees. */\nexport const DEFAULT_TRUST_PROXY = 'loopback, linklocal, uniquelocal';\n\n/** Overrides {@link DEFAULT_TRUST_PROXY}; a public cloud LB needs it set. */\nexport const TRUST_PROXY_ENV = 'GITNEXUS_TRUST_PROXY';\n\n/**\n * Sanity ceiling on a hop count, well past any real proxy chain — it exists to\n * catch a digit string long enough to overflow to `Infinity`, not to make any\n * value under it safe. The correct hop count is the exact number of proxies you\n * control; each extra hop hands the caller one more entry of the chain.\n */\nexport const MAX_TRUST_PROXY_HOPS = 16;","sourceCodeStart":270,"sourceCodeEnd":306,"githubUrl":"https://github.com/abhigyanpatwari/GitNexus/blob/aac7515d2a8c50a1f8f923c6fb77218b333560d6/gitnexus/src/server/middleware.ts#L270-L306","documentation":"When gitnexus serve binds a wildcard address (normalizeBoundHost cannot normalize it), this startup warning states exactly which origins browser write routes accept: loopback only, or loopback plus the single PUBLIC_ORIGIN host when that is configured. The point is that a wildcard bind widens reachability but does not widen browser-write acceptance, and the message tells you how to widen it deliberately.","triggerScenarios":"Running gitnexus serve --host 0.0.0.0 (or '::') at startup — typical in Docker or port-publishing setups. Read routes serve every interface; write routes stay loopback(+PUBLIC_ORIGIN)-only.","commonSituations":"Containerized deployments publishing port 4747 with a wildcard bind; users then surprised that write requests from LAN browsers are refused by CORS despite the server being reachable.","solutions":["Bind to the specific address that needs access: gitnexus serve --host 192.168.1.10","Keep the wildcard bind but set GITNEXUS_PUBLIC_ORIGIN to the one origin that needs browser writes","Leave as-is when only loopback writes are intended: the wildcard then only widens read reach"],"exampleFix":"# before\ngitnexus serve --host 0.0.0.0        # writes: loopback only (+ this warning)\n\n# after\ngitnexus serve --host 192.168.1.10   # writes from that interface's origin accepted","handlingStrategy":"validation","validationCode":"const WILDCARDS = new Set(['0.0.0.0', '::', '']);\nif (boundHost !== undefined && WILDCARDS.has(boundHost)) {\n  // Expect the wildcard-bind warning: browser write routes stay\n  // loopback(+PUBLIC_ORIGIN)-only. Decide deliberately:\n  //   bind --host <specific address>  OR  set GITNEXUS_PUBLIC_ORIGIN.\n}","typeGuard":"function isWildcardBind(host?: string): boolean {\n  return host === undefined || host === '' || host === '0.0.0.0' || host === '::';\n}","tryCatchPattern":null,"preventionTips":["Bind specific addresses instead of wildcards when writes are needed","In Docker, publish only what is needed and set GITNEXUS_PUBLIC_ORIGIN for browser writes","Read this warning as a CORS scope statement, not a malfunction"],"tags":["server","network-bind","cors","security","docker"],"backgroundTag":"wildcard-bind-exposure","analyzedSha":"aac7515d2a8c50a1f8f923c6fb77218b333560d6","analyzedAt":"2026-08-20T23:29:22.980Z","schemaVersion":2},"datasetVersion":"2026-08-22T20:17:22.307Z"}