Choose a listening address

The listening address decides which local interfaces accept connections. It’s a security decision, not a formality.

Every machine has several addresses. 127.0.0.1 is loopback: only processes on the same machine can reach it. Your LAN address (something like 192.168.1.20) is reachable by other devices on that network. 0.0.0.0 is the wildcard: it accepts IPv4 traffic reaching any interface. :: is the IPv6 equivalent, and on many systems accepts IPv4 too.

Compare two explicit bindings:

server.listen(4000, '127.0.0.1')
// later, in an authorized lab only
server.listen(4000, '0.0.0.0')

If you omit the host argument entirely, Node listens on all interfaces. That default surprises people: a “local test server” is suddenly reachable by everyone on the coffee shop wifi.

Verify the exposure

Inspect listeners after each run:

ss -lnt | grep 4000
# 127.0.0.1:4000   reachable from this machine only
# 0.0.0.0:4000     reachable on every IPv4 interface

The local address column tells you what the kernel is actually doing, regardless of what you think your code says. Trust the tool, not your memory.

To prove the difference, connect from another authorized device on the same network:

nc 192.168.1.20 4000

Against the loopback binding this fails. Against 0.0.0.0 it connects — unless a firewall blocks port 4000 in between. Test from another authorized device only when the firewall and network are understood; the result teaches you which layer is doing the protecting.

Choosing

My advice: bind to 127.0.0.1 by default. Widen the binding only when a specific consumer needs it, and you know who can reach the interface you’re opening.

A common production pattern keeps the Node service on loopback with nginx or Caddy in front, so only the proxy is exposed and it handles TLS and access control.

Binding broadly is not authentication. Anyone who can reach the port can speak your protocol. Add firewall and application controls before exposing a service beyond loopback.