From c0340aec20cd5d8c8b74709a10ce1aab44899d72 Mon Sep 17 00:00:00 2001
From: Joshua Johnson <jspspike@gmail.com>
Date: Thu, 16 Nov 2023 15:39:38 +0000
Subject: [PATCH] Change dev registry and inspector server to use 127.0.0.1
 instead of all interfaces (#4437)

(cherry picked from commit 05b1bbd2f5b8e60268e30c276067c3a3ae1239cf)
---
 .changeset/warm-dryers-double.md                   |  5 +++++
 .../wrangler/src/__tests__/api-devregistry.test.ts |  2 +-
 packages/wrangler/src/dev-registry.ts              | 14 +++++++-------
 packages/wrangler/src/inspect.ts                   |  6 +++---
 4 files changed, 16 insertions(+), 11 deletions(-)
 create mode 100644 .changeset/warm-dryers-double.md

diff --git a/.changeset/warm-dryers-double.md b/.changeset/warm-dryers-double.md
new file mode 100644
index 000000000000..b94c2876aac1
--- /dev/null
+++ b/.changeset/warm-dryers-double.md
@@ -0,0 +1,5 @@
+---
+"wrangler": patch
+---
+
+Change dev registry and inspector server to listen on 127.0.0.1 instead of all interfaces
diff --git a/packages/wrangler/src/__tests__/api-devregistry.test.ts b/packages/wrangler/src/__tests__/api-devregistry.test.ts
index a7cefe6f41e4..71a0f5f9e77e 100644
--- a/packages/wrangler/src/__tests__/api-devregistry.test.ts
+++ b/packages/wrangler/src/__tests__/api-devregistry.test.ts
@@ -40,7 +40,7 @@ describe("multi-worker testing", () => {
 	});
 
 	it("parentWorker and childWorker should be added devRegistry", async () => {
-		const resp = await fetch("http://localhost:6284/workers");
+		const resp = await fetch("http://127.0.0.1:6284/workers");
 		if (resp) {
 			const parsedResp = (await resp.json()) as {
 				parent: unknown;
diff --git a/packages/wrangler/src/dev-registry.ts b/packages/wrangler/src/dev-registry.ts
index 092018c1721e..96c173f77b32 100644
--- a/packages/wrangler/src/dev-registry.ts
+++ b/packages/wrangler/src/dev-registry.ts
@@ -1,5 +1,5 @@
-import http from "http";
 import net from "net";
+import { createServer } from "node:http";
 import bodyParser from "body-parser";
 import express from "express";
 import { createHttpTerminator } from "http-terminator";
@@ -7,11 +7,11 @@ import { fetch } from "undici";
 import { logger } from "./logger";
 
 import type { Config } from "./config";
-import type { Server } from "http";
 import type { HttpTerminator } from "http-terminator";
+import type { Server } from "node:http";
 
-const DEV_REGISTRY_PORT = "6284";
-const DEV_REGISTRY_HOST = `http://localhost:${DEV_REGISTRY_PORT}`;
+const DEV_REGISTRY_PORT = 6284;
+const DEV_REGISTRY_HOST = `http://127.0.0.1:${DEV_REGISTRY_PORT}`;
 
 let server: Server | null;
 let terminator: HttpTerminator;
@@ -48,7 +48,7 @@ async function isPortAvailable() {
 				netServer.close();
 				resolve(true);
 			});
-		netServer.listen(DEV_REGISTRY_PORT);
+		netServer.listen(DEV_REGISTRY_PORT, "127.0.0.1");
 	});
 }
 
@@ -80,9 +80,9 @@ export async function startWorkerRegistry() {
 				workers = {};
 				res.json(null);
 			});
-		server = http.createServer(app);
+		server = createServer(app);
 		terminator = createHttpTerminator({ server });
-		server.listen(DEV_REGISTRY_PORT);
+		server.listen(DEV_REGISTRY_PORT, "127.0.0.1");
 
 		/**
 		 * The registry server may have already been started by another wrangler process.
diff --git a/packages/wrangler/src/inspect.ts b/packages/wrangler/src/inspect.ts
index 2c7c7f38d56f..bf5727cd7270 100644
--- a/packages/wrangler/src/inspect.ts
+++ b/packages/wrangler/src/inspect.ts
@@ -110,7 +110,7 @@ export default function useInspector(props: InspectorProps) {
 					case "/json/list":
 						{
 							res.setHeader("Content-Type", "application/json");
-							const localHost = `localhost:${props.port}/ws`;
+							const localHost = `127.0.0.1:${props.port}/ws`;
 							const devtoolsFrontendUrl = `devtools://devtools/bundled/js_app.html?experiments=true&v8only=true&ws=${localHost}`;
 							const devtoolsFrontendUrlCompat = `devtools://devtools/bundled/inspector.html?experiments=true&v8only=true&ws=${localHost}`;
 							res.end(
@@ -197,7 +197,7 @@ export default function useInspector(props: InspectorProps) {
 				timeout: 2000,
 				abortSignal: abortController.signal,
 			});
-			server.listen(props.port);
+			server.listen(props.port, "127.0.0.1");
 		}
 		startInspectorProxy().catch((err) => {
 			if ((err as { code: string }).code !== "ABORT_ERR") {
@@ -844,7 +844,7 @@ export const openInspector = async (
 ) => {
 	const query = new URLSearchParams();
 	query.set("theme", "systemPreferred");
-	query.set("ws", `localhost:${inspectorPort}/ws`);
+	query.set("ws", `127.0.0.1:${inspectorPort}/ws`);
 	if (worker) query.set("domain", worker);
 	const url = `https://devtools.devprod.cloudflare.dev/js_app?${query.toString()}`;
 	const errorMessage =