Does Node.js server.listen() without a host argument always bind to all interfaces, and is localhost-only binding still opt-in?
I'm reviewing the network exposure defaults for a Node.js service built on the documented http.createServer().listen(port[, host]) API. My understanding is that omitting the host argument binds to all available IPv4 and IPv6 addresses ( 0.0.0.0 and :: ), which means a service can become reachable from external networks unless a firewall blocks it. I want to