Merge pull request #6321 from alphagov/run-locally-default

Only listen for local connections by default

Author: 36degrees

docs/contributing/running-locally.md

@@ -42,6 +42,12 @@ This will build sources, serve pages and watch for changes.
 npm start
 ```
 
+By default, the local server will only accept connections from the same machine. If you need to allow external connections, for example if you want to test from another device, you'll need to set the `ALLOW_EXTERNAL_CONNECTIONS` environment variable to `true`:
+
+```shell
+ALLOW_EXTERNAL_CONNECTIONS=true npm start
+```
+
 ## Deploying
 
 You can deploy your project straight to a Heroku instance.

jest-dev-server.config.js

@@ -5,6 +5,9 @@ const { ports } = require('@govuk-frontend/config')
  */
 module.exports = {
   command: 'npm start --workspace @govuk-frontend/review',
+
+  host: 'localhost',
+
   port: ports.app,
 
   // Allow 30 seconds to start server

packages/govuk-frontend-review/browsersync.config.js

@@ -18,6 +18,11 @@ const frontendPath = packageTypeToPath('govuk-frontend', {
 module.exports = {
   proxy: urls.app,
 
+  // Bind to localhost only by default
+  ...(process.env.ALLOW_EXTERNAL_CONNECTIONS === 'true'
+    ? {}
+    : { listen: 'localhost' }),
+
   // Prevent browser mirroring
   ghostMode: false,
 

packages/govuk-frontend-review/src/start.mjs

@@ -4,4 +4,7 @@ import app from './app.mjs'
 
 const server = await app()
 
-server.listen(ports.app)
+server.listen({
+  host: 'localhost',
+  port: ports.app
+})