INNER CODE UNIT · Python
_warn_if_unauthenticated_bind
shenmintao/marginalia · src/marginalia/main.py:119
def _warn_if_unauthenticated_bind(settings) -> None:
"""Loud startup warning when the configured bind host is non-loopback
and no MARGINALIA_API_TOKEN is set: every endpoint is then reachable
unauthenticated by any host on the network. Intentionally a warning,
not a hard failure — existing tokenless loopback deployments and
reverse-proxy setups keep working."""
if settings.marginalia_api_token:
return
host = os.environ.get("MARGINALIA_API_HOST") or settings.marginalia_api_host
try:
is_loopback = ipaddress.ip_address(host).is_loopback
except ValueError:
is_loopback = host.lower() == "localhost"
if is_loopback:
return
log.warning(
"\n"
"================================================================\n"