fix: bind example servers to localhost by default

README.md

@@ -53,7 +53,7 @@ Requires PHP 8.2+.
 ```bash
 cd server/php
 composer install
-php -S 0.0.0.0:3022 -t . app.php
+php -S 127.0.0.1:3022 -t . app.php
 # http://localhost:3022
 ```
 

client/web-next/README.md

@@ -41,7 +41,7 @@ Start that sidecar before using this UI. Only node-ts is set up for browser call
 1. Go to this directory: `cd ./client/web-next`
 1. Add a `.env` file based on `.env.example` (see **Configuration** above).
 1. Run `npm install` to install the dependencies.
-1. Run `npm run dev` to start the development server. If you want to use a specific port, you can run `npm run dev -- --port <port>`.
+1. Run `npm run dev` to start the development server. If you want to use a specific port, you can run `npm run dev -- --port <port>`, and set `CORS_ORIGIN=http://localhost:<port>` in `server/node-ts/.env` so the sidecar allows browser calls from it.
 1. Visit `http://localhost:<port>` in your browser, you will see an error in the same terminal where you ran `npm run dev` - it will show simple information about Trust Client SDK initialization, and let you get a source token on demand.
 
 ## What is special about Next JS and Composer?

client/web-next/package.json

@@ -12,7 +12,7 @@
   "dependencies": {
     "@dodgeball/trust-sdk-client": "^0.0.38",
     "@faker-js/faker": "^10.6.0",
-    "next": "15.5.27",
+    "next": "15.5.28",
     "react": "^19.0.0",
     "react-dom": "^19.0.0"
   },

server/README.md

@@ -32,6 +32,8 @@ DODGEBALL_SECRET_KEY=your_secret_key
 
 `SPREEDLY_API_URL` and `SPREEDLY_SECRET_KEY` are also accepted when the `DODGEBALL_*` names are unset.
 
+The servers listen on `127.0.0.1`, so only this machine can reach them. Set `HOST=0.0.0.0` to accept connections from other machines, for example in a container or behind a load balancer. The Docker images already set it. For PHP, change the address in the `php -S` command.
+
 ## Run locally
 
 ### Node (TypeScript)
@@ -60,7 +62,7 @@ Requires PHP 8.2+.
 ```bash
 cd server/php
 composer install
-php -S 0.0.0.0:3022 -t . app.php
+php -S 127.0.0.1:3022 -t . app.php
 # http://localhost:3022
 ```
 
@@ -170,7 +172,7 @@ PHP's built-in server, Sinatra, Go's `net/http` package, a minimal Java HTTP ser
 
 Call `checkpoint` from a route that already authenticates the user, such as `POST /api/orders`. Do not expose an unauthenticated `/checkpoint`.
 
-The node example allows any origin so the browser clients in `client/` can call `http://localhost:3020`. If a browser will call your API, set `Access-Control-Allow-Origin` to your frontend origin.
+The node example allows browser calls from `http://localhost:3000`, the origin of the web-next client in `client/`. If you run web-next on another port or open it at `http://127.0.0.1:3000`, set `CORS_ORIGIN` to match. If a browser will call your API, set `Access-Control-Allow-Origin` to your frontend origin.
 
 ## SDK repositories
 

server/docker-compose.yml

@@ -13,7 +13,7 @@ services:
       additional_contexts:
         sdk: ../../composer-sdk-server-node
     ports:
-      - "3020:3020"
+      - "127.0.0.1:3020:3020"
     env_file:
       - path: ./node-ts/.env
         required: false
@@ -24,7 +24,7 @@ services:
       additional_contexts:
         sdk: ../../composer-sdk-server-python
     ports:
-      - "3021:3021"
+      - "127.0.0.1:3021:3021"
     env_file:
       - path: ./python/.env
         required: false
@@ -35,7 +35,7 @@ services:
       additional_contexts:
         sdk: ../../composer-sdk-server-php
     ports:
-      - "3022:3022"
+      - "127.0.0.1:3022:3022"
     env_file:
       - path: ./php/.env
         required: false
@@ -46,7 +46,7 @@ services:
       additional_contexts:
         sdk: ../../composer-sdk-server-ruby
     ports:
-      - "3023:3023"
+      - "127.0.0.1:3023:3023"
     env_file:
       - path: ./ruby/.env
         required: false
@@ -57,7 +57,7 @@ services:
       additional_contexts:
         sdk: ../../composer-sdk-server-go
     ports:
-      - "3024:3024"
+      - "127.0.0.1:3024:3024"
     env_file:
       - path: ./go/.env
         required: false
@@ -68,7 +68,7 @@ services:
       additional_contexts:
         sdk: ../../composer-sdk-server-java
     ports:
-      - "3025:3025"
+      - "127.0.0.1:3025:3025"
     env_file:
       - path: ./java/.env
         required: false
@@ -79,7 +79,7 @@ services:
       additional_contexts:
         sdk: ../../composer-sdk-server-dotnet
     ports:
-      - "3026:3026"
+      - "127.0.0.1:3026:3026"
     env_file:
       - path: ./dotnet/.env
         required: false

server/dotnet/Dockerfile

@@ -16,7 +16,7 @@ FROM mcr.microsoft.com/dotnet/aspnet:10.0
 WORKDIR /app
 COPY --from=build /out .
 ENV PORT=3026
-ENV ASPNETCORE_URLS=http://0.0.0.0:3026
+ENV HOST=0.0.0.0
 EXPOSE 3026
 USER $APP_UID
 ENTRYPOINT ["dotnet", "Sidecar.dll"]

server/dotnet/Program.cs

@@ -16,7 +16,8 @@
 var sdkMeta = new SdkMeta("dotnet", "Spreedly.ComposerSdk.Server", "1.0.0");
 
 var port = EnvOrDefault("PORT", "3026");
-Environment.SetEnvironmentVariable("ASPNETCORE_URLS", $"http://0.0.0.0:{port}");
+var host = EnvOrDefault("HOST", "127.0.0.1");
+Environment.SetEnvironmentVariable("ASPNETCORE_URLS", $"http://{host}:{port}");
 
 var secretKey = EnvOr("DODGEBALL_SECRET_KEY", "SPREEDLY_SECRET_KEY");
 if (!IsApiKeyConfigured(secretKey))

server/go/Dockerfile

@@ -22,6 +22,7 @@ FROM gcr.io/distroless/static-debian12:nonroot
 WORKDIR /app
 COPY --from=build --chown=nonroot:nonroot /app/sidecar /app/sidecar
 ENV PORT=3024
+ENV HOST=0.0.0.0
 EXPOSE 3024
 USER nonroot
 ENTRYPOINT ["/app/sidecar"]

server/go/main.go

@@ -68,6 +68,11 @@ func main() {
 		port = "3024"
 	}
 
+	host := os.Getenv("HOST")
+	if host == "" {
+		host = "127.0.0.1"
+	}
+
 	secretKey := envOr("DODGEBALL_SECRET_KEY", "SPREEDLY_SECRET_KEY")
 	if secretKey == "" {
 		secretKey = "UNSET_SECRET_KEY"
@@ -93,7 +98,7 @@ func main() {
 	http.HandleFunc("/checkpoint", checkpointHandler(client))
 
 	log.Printf("Server is running on http://localhost:%s", port)
-	log.Fatal(http.ListenAndServe(":"+port, nil))
+	log.Fatal(http.ListenAndServe(host+":"+port, nil))
 }
 
 func healthzHandler(w http.ResponseWriter, _ *http.Request) {

server/java/Dockerfile

@@ -31,5 +31,6 @@ COPY --from=build /app/target/java-sidecar-1.0.0.jar /app/sidecar.jar
 RUN useradd --uid 10001 --no-create-home sidecar
 USER sidecar
 ENV PORT=3025
+ENV HOST=0.0.0.0
 EXPOSE 3025
 CMD ["java", "-jar", "/app/sidecar.jar"]

server/java/src/main/java/com/spreedly/composer/examples/SidecarApp.java

@@ -44,14 +44,15 @@ public final class SidecarApp {
 
     public static void main(String[] args) throws Exception {
         String port = envOrDefault("PORT", "3025");
+        String host = envOrDefault("HOST", "127.0.0.1");
         String secretKey = envOr("DODGEBALL_SECRET_KEY", "SPREEDLY_SECRET_KEY");
         if (!isApiKeyConfigured(secretKey)) {
             System.out.println("warning: " + MISSING_CONFIG_MESSAGE);
         }
 
         Composer composer = buildComposer(secretKey);
 
-        HttpServer server = HttpServer.create(new InetSocketAddress(Integer.parseInt(port)), 0);
+        HttpServer server = HttpServer.create(new InetSocketAddress(host, Integer.parseInt(port)), 0);
         server.createContext("/healthz", exchange -> {
             if (!"GET".equals(exchange.getRequestMethod())) {
                 sendText(exchange, 405, "Method not allowed");

server/node-ts/.env.example

@@ -2,3 +2,5 @@ DODGEBALL_API_URL=https://api.sandbox.dodgeballhq.com
 DODGEBALL_SECRET_KEY=
 # How many reverse proxies sit in front. 0 = socket address; ignore X-Forwarded-For.
 TRUSTED_PROXY_COUNT=0
+# Browser origin allowed to call this server (the web-next client by default).
+CORS_ORIGIN=http://localhost:3000

server/node-ts/Dockerfile

@@ -35,6 +35,7 @@ RUN npm install --install-links
 COPY tsconfig.json ./
 COPY src ./src
 ENV PORT=3020
+ENV HOST=0.0.0.0
 EXPOSE 3020
 USER node
 CMD ["./node_modules/.bin/ts-node", "src/index.ts"]