This is an issue when a web server uses host="0.0.0.0", which binds the application to all available network interfaces on the host machine.

Why is this an issue?

When you start a Web server, you need to specify which network interface it should listen on. A network interface is a connection point between your computer and a network.

The special IP address 0.0.0.0 tells the application to bind to all network interfaces on the machine. This means the application becomes accessible from:

This broad exposure violates the principle of least privilege, which states that a system should only have access to the resources it needs to function. By binding to all interfaces, you’re making your application accessible from networks where it shouldn’t be reachable.

In development environments, this is particularly risky because:

Even in production environments, binding to 0.0.0.0 should be a deliberate choice made with proper security controls in place, such as:

When these controls are absent, binding to all interfaces creates an unnecessarily large attack surface.

What is the potential impact?

Binding to all network interfaces can lead to several security risks:

The severity depends on the environment and what security controls are in place, but the risk is highest in development environments where security measures are typically minimal.

How to fix it in Flask

For development, bind to localhost only. For production, use a proper WSGI server instead of app.run().

Code examples

Noncompliant code example

from flask import Flask
app = Flask(__name__)
@app.route('/')
def hello():
    return 'Hello World!'
if __name__ == '__main__':
    app.run(host='0.0.0.0', debug=True)  # Noncompliant

Compliant solution

from flask import Flask
app = Flask(__name__)
@app.route('/')
def hello():
    return 'Hello World!'
if __name__ == '__main__':
    app.run(host='0.0.0.0', debug=False)

Noncompliant code example

import os
from flask import Flask
app = Flask(__name__)
if __name__ == '__main__':
    app.run(host='0.0.0.0', port=5000, debug=True)  # Noncompliant

Compliant solution

import os
from flask import Flask
app = Flask(__name__)
if __name__ == '__main__':
    app.run(host='127.0.0.1', port=5000, debug=True)

How to fix it in FastAPI

For development and local testing, bind to localhost (127.0.0.1 or localhost) instead of all interfaces. This ensures the application is only accessible from your local machine.

Code examples

Noncompliant code example

import uvicorn
from fastapi import FastAPI

app = FastAPI()

if __name__ == "__main__":
    uvicorn.run(app, host="0.0.0.0", port=8000)  # Noncompliant

Compliant solution

import uvicorn
from fastapi import FastAPI

app = FastAPI()

if __name__ == "__main__":
    uvicorn.run(app, host="127.0.0.1", port=8000)

Resources

Documentation

Standards