Are you talking about the difference between 0.0.0.0 and 127.0.0.1 /localhost (loopback address)? If so It should be a tiny thing to change to implement I can add that on the next update- I just went with the express JS defaults to keep things simple:)

Or I can even make a flag to configure this :thinking

`app.listen` uses the same signature as Node's `server.listen`. You can specify the `host` [0] or else it defaults to `0.0.0.0`. This means that when you run this service, it will be accessible to anyone that can reach the server.

Typically, services allow you set the host address by configuration. This way you can set it to `127.0.0.1` so that it is only available locally.

[0]: https://nodejs.org/api/net.html#serverlistenport-host-backlo...

If you do make it configurable, it's still a good idea to make the default `127.0.0.1` for the reasons @ggpsv mentioned. Since the link automatically opens at `http://localhost:PORT` anyway, it's an easy security win.

It does, but express doesn't tell it directly in the docs.

Instead http://expressjs.com/en/4x/api.html#app.listen sends you to https://nodejs.org/api/http.html#http_server_listen which also won't give the answer but sends you to https://nodejs.org/api/net.html#serverlisten which at some points finally documents that default is 0.0.0.0.

Welcome to the JavaScript ecosystem :/

I wouldn't exactly call this a failure of the JS ecosystem. The Express documentation you've linked to mentions that the host is the (optional) second argument to the listen function:

> app.listen([port[, host[, backlog]]][, callback])

You literally just have to run:

  app.listen(3000, '127.0.0.1')

If you don't trust the network you're on you should just be explicit about which IP address you'd like to listen on.

That's a sensible default. It would be super frustrating if by default the web server you built couldn't be accessed by anyone else in your network.