How to restrict the interfaces on which the server listens?

[netheril96]

When I run blitz start, not only is the server accessible from localhost, but also from the LAN. I don't have a public IPv4, so I don't know if the website is accessible to the public. Either way, this is a security risk, since in development we usually do not implement tight security controls in the beginning.

How to restrict the interfaces the server listens on? I want it to listen on loopback only.

[benatkin]

It seems like changing the start script in package.json to blitz start -H 127.0.0.1 or running yarn start -H 127.0.0.1 ought to work. Node itself defaults to 0.0.0.0: https://nodejs.org/api/net.html#net_server_listen_options_callback