Change default ListenIp of Http server to 0.0.0.0

We see that a lot of support tickets are caused by this default setting,
as it is one of the things that blocks connections to the server with no
obvious indication that this is happening. To make it easier for first
time users to set up Impostor, it is important that this setting is
changed.

Previously we also recommended against direct exposing due to security
reasons, but I believe this fear to be unfounded: Microsoft claims that
the Kestrel server is hardened against web server vulnerabilities and
supports its use both with and without a reverse proxy.[1]

We still recommend using reverse proxies if HTTPS support is needed, so
that section of documentation still remains. Setting the ListenIp to
127.0.0.1 is still recommended when using a reverse proxy to remove the
ability for people to connect directly, so we add it there as a recommendation.

[1]: https://learn.microsoft.com/en-us/aspnet/core/fundamentals/servers/kestrel/when-to-use-a-reverse-proxy?view=aspnetcore-8.0

diff --git a/Dockerfile b/Dockerfile
index 9792a1ac9d1bc0091a89f39f1414fe0d25d3677e..8fb50d9c00f3b6625c1fff974b5e05545f6bfd53 100644 (file)
--- a/Dockerfile
+++ b/Dockerfile
@@ -40,8 +40,6 @@ FROM --platform=$TARGETPLATFORM mcr.microsoft.com/dotnet/aspnet:7.0
 WORKDIR /app
 COPY --from=build /app ./
 
-# Make the HttpServer listen to 0.0.0.0 to expose it to the outside world.
-ENV IMPOSTOR_HttpServer__ListenIp=0.0.0.0
 # Override ASPNETCORE_URLS to stop warning.
 ENV ASPNETCORE_URLS=
 

diff --git a/docs/Http-server.md b/docs/Http-server.md
index f74eeff7a8ef018a934cb45f451ce770779d5f64..fd54685a68edbea92cdad6a29d385ff0d46ba3ce 100644 (file)
--- a/docs/Http-server.md
+++ b/docs/Http-server.md
@@ -4,8 +4,8 @@ Since Impostor 1.9.0 a HTTP service is included for matchmaking. Recent versions
 
 Depending on whether you want to support mobile players, you can set up the HTTP server in one of two ways:
 
-- Directly expose the HTTP server. Simpler, but only works if you don't want to support mobile players
-- Use a reverse proxy to expose the HTTP safer. More complex, but allows mobile players to connect
+- Directly expose the HTTP server. Simpler, but only works if you don't want to support mobile players.
+- Use a reverse proxy to expose the HTTP server. More complex, but allows mobile players to connect.
 
 ## Directly expose the HTTP server.
 
@@ -17,6 +17,8 @@ A reverse proxy allows you to forward HTTP requests from users to multiple servi
 
 If you have never set up a reverse proxy before, we recommend you to set up [Caddy](https://caddyserver.com/). It is easy to set up and comes with support for requesting SSL certificates out of the box.
 
+To prevent people from connecting directly to Impostor, we recommend changing the "ListenIp" in the "HttpServer" section to "127.0.0.1". This makes sure people can't connect to your HTTP server other than via your reverse proxy. Keep the "ListenIp" in the "Server" section at "0.0.0.0" though, running the normal game traffic through a proxy is not supported.
+
 ### Caddy
 
 To install Caddy, follow the [official installation guide](https://caddyserver.com/docs/install). Then use the following lines as your `Caddyfile` configuration file:

diff --git a/docs/Running-the-server.md b/docs/Running-the-server.md
index 4443dd35af5950d22ca0b19b9cdc8ce40cb7496c..9bc8f77da1de4d37b8c5573817c08c67a33daf43 100644 (file)
--- a/docs/Running-the-server.md
+++ b/docs/Running-the-server.md
@@ -34,7 +34,7 @@ Docker is a program that allows you to run programs like Impostor in a container
 After installing Docker, you can just start a Docker container with `docker run`:
 
 ```
-docker run -p 127.0.0.1:22023:22023/tcp -p 22023:22023/udp -e IMPOSTOR_Server__PublicIp=your.public.ip.here aeonlucid/impostor:nightly
+docker run -p 22023:22023/tcp -p 22023:22023/udp -e IMPOSTOR_Server__PublicIp=your.public.ip.here aeonlucid/impostor:nightly
 ```
 
 Please replace `your.public.ip.here` with the public IP address of your server. This is the address Among Us will try to reach your server at.
@@ -53,7 +53,7 @@ services:
     image: aeonlucid/impostor:nightly
     container_name: impostor
     ports:
-      - 127.0.0.1:22023:22023/tcp # Remove "127.0.0.1:" if you want to expose Impostor's HTTP server directly to the internet
+      - 22023:22023/tcp # Add "127.0.0.1:" if you're using a reverse proxy to terminate HTTPS
       - 22023:22023/udp
     environment: # Either configure Impostor using environment variables or mount a copy of config.json
       - IMPOSTOR_Server__PublicIp=your.public.ip.here

diff --git a/docs/Server-configuration.md b/docs/Server-configuration.md
index 0c33d137a60502d397203b6d7ceaa39d10907379..21bee106b49c258c6d1b2a478211437bf6c45edb 100644 (file)
--- a/docs/Server-configuration.md
+++ b/docs/Server-configuration.md
@@ -17,11 +17,11 @@ Some information about all the possible configurations. Click [here](https://git
 
 Impostor has an Http Server that is used by recent versions of Among Us to connect to. See [the Http Server page](Http-server.md) for more details on how to set this up.
 
-| Key            | Default     | Description                                                                                                                                                                                  |
-|----------------|-------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
-| **Enabled**    | `true`      | Whether the http server should be enabled.                                                                                                                                                   |
-| **ListenIp**   | `127.0.0.1` | The network interface to listen on. Use `127.0.0.1` if you use a reverse proxy or just run locally. Use `0.0.0.0` if you are directly exposing this server to the internet (not recommended) |
-| **ListenPort** | `22023`     | The listen port of this server. For port forwarding purposes, this is an TCP port.                                                                                                           |
+| Key            | Default   | Description                                                                                                                                                                |
+|----------------|-----------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
+| **Enabled**    | `true`    | Whether the http server should be enabled.                                                                                                                                 |
+| **ListenIp**   | `0.0.0.0` | The network interface to listen on. Use `127.0.0.1` if you use a reverse proxy or just run locally. Use `0.0.0.0` if you are directly exposing this server to the internet |
+| **ListenPort** | `22023`   | The listen port of this server. For port forwarding purposes, this is an TCP port.                                                                                         |
 
 ### AntiCheat
 

diff --git a/src/Impostor.Api/Config/HttpServerConfig.cs b/src/Impostor.Api/Config/HttpServerConfig.cs
index fd3cda2d1273359b18ee496e8421dff896ac8bf3..bf7354d1c95eaccfc2d962e5953571ea1a6bb92b 100644 (file)
--- a/src/Impostor.Api/Config/HttpServerConfig.cs
+++ b/src/Impostor.Api/Config/HttpServerConfig.cs
@@ -16,8 +16,8 @@ public class HttpServerConfig
     /// Gets or sets the IP address the HTTP Matchmaking server will listen on.
     /// </summary>
     /// Use "127.0.0.1" if you are running behind a reverse proxy or just testing locally.
-    /// Use "0.0.0.0" if you are directly exposing this server to the internet (not recommended).
-    public string ListenIp { get; set; } = "127.0.0.1";
+    /// Use "0.0.0.0" if you are directly exposing this server to the internet.
+    public string ListenIp { get; set; } = "0.0.0.0";
 
     /// <summary>
     /// Gets or sets the port the HTTP Matchmaking server will listen on.

diff --git a/src/Impostor.Server/config-full.json b/src/Impostor.Server/config-full.json
index 9ffb3531d134e91ec5dfc44e4b9fbbbfaf5dd4c2..83625b1308bf389416ebd0baf5efb745d4824566 100644 (file)
--- a/src/Impostor.Server/config-full.json
+++ b/src/Impostor.Server/config-full.json
@@ -7,7 +7,7 @@
   },
   "HttpServer": {
     "Enabled": true,
-    "ListenIp": "127.0.0.1",
+    "ListenIp": "0.0.0.0",
     "ListenPort": 22023
   },
   "AntiCheat": {

diff --git a/src/Impostor.Server/config.json b/src/Impostor.Server/config.json
index fbad991c2173bd89724e7041d29343f4c4176732..a26a7b1d8d630e25a7559be10414c876815a1806 100644 (file)
--- a/src/Impostor.Server/config.json
+++ b/src/Impostor.Server/config.json
@@ -7,7 +7,7 @@
   },
   "HttpServer": {
     "Enabled": true,
-    "ListenIp": "127.0.0.1",
+    "ListenIp": "0.0.0.0",
     "ListenPort": 22023
   },
   "AntiCheat": {