Change Default HTTP IP? about mailcatcher HOT 3 CLOSED

Mailcatcher binds to the local interface because the default use case is a developer running it on their local machine to test against and they only need local access. Binding to all interfaces could be a security issue for the default use case. Anybody with HTTP access to mailcatcher can clear all mail or quit. Mailcatcher also isn't hardened so running a public service by default could also expose potential attack vectors.

There is, however, an option to change the bind IP for just such cases as running a staging box:

mailcatcher --http-ip=0.0.0.0

Thanks. :-)

from mailcatcher.

I really view mailcatcher as a development time only thing so security seems like a lower concern to me, but I understand. The command line option works great so thanks.

from mailcatcher.

For anyone finding this later, this didn't work for me - I had to put the actual IP of the machine. Then it was fine. (Mailcatcher was running on Mac OX 10.10 and I was trying to reach it from a VM in Virtualbox)

Given the rise of Virtual Machine environments for dev work, these options should maybe be mentioned on http://mailcatcher.me/ ? I do agree these are the best defaults for security reasons tho.

Thanks for the software - it's great!

from mailcatcher.