Skip to content

chore: default --host to localhost (was 127.0.0.1) - #22

Merged
melvincarvalho merged 1 commit into
gh-pagesfrom
feat-default-host-localhost
May 16, 2026
Merged

melvincarvalho merged 1 commit into
gh-pagesfrom
feat-default-host-localhost

Conversation

@melvincarvalho

Copy link
Copy Markdown
Contributor

Summary

Switches jspod's default `--host` from `127.0.0.1` to `localhost`.

Why

Non-changes

  • Server-side reachability: identical. Node's `localhost` bind covers both `127.0.0.1` and `::1` loopback.
  • Safety: `localhost` is still loopback-only; the LAN-exposure warning still fires for any non-loopback bind, and `localhost` is already in the loopback check.

Migration note for existing users

Browsers treat `http://127.0.0.1:5444\` and `http://localhost:5444\` as separate origins. IndexedDB (where solid-oidc stores tokens) is per-origin. Anyone upgrading from a prior jspod where they signed in via the `127.0.0.1` URL will need to sign in fresh via the new `localhost` URL. The pod-data on disk is unaffected; it's just the JS-side session.

Test plan

  • Local: banner shows `http://localhost:5444\`, Host `localhost`
  • Local: server reachable via both `localhost` and `127.0.0.1`
  • Browser: sign-in flow works against `http://localhost:5444/\` IdP (verified)
  • Browser: Pilot at `/public/apps/pilot/` works same-origin (verified)

Bumps jspod to 0.0.24.

Browsers treat 127.0.0.1 and localhost as separate origins for
storage, but for first-run UX localhost is the friendlier and more
familiar default — matches Vite, Next.js dev, etc. — and WebAuthn
(passkeys) explicitly requires the Relying Party ID to be 'localhost'
or a real domain, so this also unlocks the eventual rung-3 climb.

Server-side reachability is unchanged: Node's localhost bind covers
both 127.0.0.1 and ::1 loopback. Existing users with browser data
keyed to the old 127.0.0.1 origin will need to sign in again
(IndexedDB is per-origin).

- options.host default: '127.0.0.1' → 'localhost'
- Banner / auto-open URL / IDP issuer follow automatically via formatUrl
- Help text + README + inline LAN-warning copy updated
- Loopback-check still accepts both names (no behaviour change there)

Bumps jspod to 0.0.24.
@melvincarvalho
melvincarvalho merged commit 822e468 into gh-pages May 16, 2026
@melvincarvalho
melvincarvalho deleted the feat-default-host-localhost branch May 16, 2026 08:34
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant