task_showcase: default bind 0.0.0.0 contradicts the documented 127.0.0.1:5005
Nobody has claimed this yet.
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 88/100
- Issue type
- Bug
- Clarity
- Clearly specified
- Activity status
- Active
- Domain
- documentation, security
Research direction
Start with assets/task_showcase/app.py:248-260 and assets/task_showcase/README.md's Run section. Verify the current default bind and the documented URL, then run python app.py and confirm the default is loopback while --host 0.0.0.0 remains an explicit option; update the README to mention that option.
Written by the indexing model from the issue text.
Description
assets/task_showcase/app.py defaults its Flask bind to 0.0.0.0 while the README next to it documents python app.py as serving http://127.0.0.1:5005. The app is a read-only, unauthenticated renderer over local run artifacts, so the default quietly puts those artifacts (task definitions, reports, screenshots) on the LAN instead of loopback.
Current code (main)
assets/task_showcase/app.py:248-260:
parser.add_argument("--host", default="0.0.0.0")
parser.add_argument("--port", type=int, default=5005)
...
app.run(host=args.host, port=args.port, debug=args.debug)
assets/task_showcase/README.md Run section:
pip install flask
python app.py # serves http://127.0.0.1:5005
The two disagree: following the README's plain python app.py binds all interfaces. Anyone on the same network can read the served tasks/reports; there is no auth on any route (fine for loopback, surprising for 0.0.0.0). Windows Firewall will typically prompt on first run, but a prompt accepted once (or a Linux host with no host firewall) leaves it exposed.
Suggested fix
Default --host to 127.0.0.1, matching the README; keep --host 0.0.0.0 as the explicit opt-in for users who do want to share the dashboard on their network, and mention that flag in the README's Run section. One-line change plus a doc line.
- Dominant language
- Python
- Stars
- 6k
- Forks
- 385
- PR merge metrics
- No merged PRs in 30d
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from microsoft/Webwright
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
-
Difficulty 1/5 Under an hour Newbie friendliness 78/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
-
Difficulty 4/5 3-5 days Newbie friendliness 45/100
-
Difficulty 4/5 3-5 days Newbie friendliness 35/100
All issues in microsoft/Webwright
Similar issues
-
bug confirmed issue
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
open-webui/open-webui#30750 · 1 comment ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
-
enhancement
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
OpenwaterHealth/openmotion-bloodflow-app#604 · 1 comment ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
-
good first issue
Difficulty 1/5 Under an hour Newbie friendliness 90/100