Electron.NET serves webpages over network #279

New Issue

claunia · 2026-01-29T16:35:36Z

claunia commented

2026-01-29 16:35:36 +00:00

Originally created by @The-MAZZTer on GitHub (Feb 10, 2019).

From the console window that shows when you run electronize start:

ASP.NET should be configured to listen on 127.0.0.1, not 0.0.0.0, as the latter allows for external computers to connect, which is not desired for Electron.

Originally created by @The-MAZZTer on GitHub (Feb 10, 2019). From the console window that shows when you run electronize start: Now listening on: http://0.0.0.0:8001 ASP.NET should be configured to listen on 127.0.0.1, not 0.0.0.0, as the latter allows for external computers to connect, which is not desired for Electron.

claunia closed this issue

2026-01-29 16:35:36 +00:00

claunia commented

2026-01-29 16:35:36 +00:00

@JimmyTheJ commented on GitHub (Feb 11, 2019):

Correct, so don't expose all IPs like that in your dotnet code.

Just add .UseUrls() in program.cs, or add a JSON config to setup your kestrel or whatever other way you want to configure it.

@JimmyTheJ commented on GitHub (Feb 11, 2019): Correct, so don't expose all IPs like that in your dotnet code. Just add .UseUrls() in program.cs, or add a JSON config to setup your kestrel or whatever other way you want to configure it.

claunia commented

2026-01-29 16:35:37 +00:00

@The-MAZZTer commented on GitHub (Feb 13, 2019):

I think I ended up with 0.0.0.0 just following the README quickstart (I had no .UseUrls) ~~so I assume that is the ASP.NET default?~~ Perhaps .UseElectron should call .UseUrls for you? (Not like you need to know the url anyway, it's all internal.) Or at least the code sample in README should have a .UseUrls?

Edit: If I call .UseUrls before .UseElectron, it has NO EFFECT. I have to call it AFTER .UseElectron. I think .UseElectron is trying to force 0.0.0.0. I think this should be considered a potential security vulnerability since even if the developer indicates 0.0.0.0 should not be used, it is still used.

Edit 2: I was correct, I went looking for the function in the code and found this:

2fb3062d4b

@The-MAZZTer commented on GitHub (Feb 13, 2019): I think I ended up with 0.0.0.0 just following the README quickstart (I had no .UseUrls) ~~so I assume that is the ASP.NET default?~~ Perhaps .UseElectron should call .UseUrls for you? (Not like you need to know the url anyway, it's all internal.) Or at least the code sample in README should have a .UseUrls? Edit: If I call .UseUrls before .UseElectron, it has NO EFFECT. I have to call it AFTER .UseElectron. I think .UseElectron is trying to force 0.0.0.0. I think this should be considered a potential security vulnerability since even if the developer indicates 0.0.0.0 should not be used, it is still used. Edit 2: I was correct, I went looking for the function in the code and found this: https://github.com/ElectronNET/Electron.NET/commit/2fb3062d4b11cbafe5ad8fe9c689626584ffbb36

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: starred/Electron.NET#279