Prevent OSX firewall from popping up when developing AppEngine Go Application

Question

I'm currently locally developing an AppEngine app using the Go programming language. My operating system is Mac OS X 10.8.3.

I keep AppEngine's development server (dev_appserver.py) running as I develop. Every time I save one of my application files (which the server is watching for changes), the OS X firewall dialog pops up saying "Do you want to allow _go_app to receive incoming connections?". The dialog is only visible for less than a second before it disappears again.

How can I get it to stop popping up all the time? I've tried having explicit rules in the OS X firewall for both the _go_app application and simply Python to accept or deny incoming connections, but not matter what it keeps (briefly) popping up.

Osswald

dont know apple firewall, but instead of this, i really could recommend you Little Snitch instead, i dont have any problems with it, just define the rules when an app tries todo something. obdev.at/products/littlesnitch/index-de.html – Honest

Answer 1

Don't know if something changed, but I was getting this error using the GCloud SDK bundled dev_appserver.py. (2019-02-03, MacOS Mojave/10.14, Google Cloud SDK 232.0.0) with Go 1.11.

With Go 1.11, binding explicitly to localhost helps:

host := ""
if os.Getenv("NODE_ENV") == "development" {
  host = "localhost"
  log.Printf("Binding to 'localhost' only for '%s'", envPurpose)
}

srv := &http.Server{
  Handler:      r,
  Addr:         fmt.Sprintf("%s:%s", host, port),
  WriteTimeout: 10 * time.Second,
  ReadTimeout:  10 * time.Second,
}

log.Fatal(srv.ListenAndServe())

EDIT: But, while this prevented the "deny/allow" popup on the initial start, it didn't help on automatic restarts unless I didn't explicitly declare handlers in the app.yaml file. Clearly, there's more going on under the hood.

However, with "bare" app.yaml files, it worked as desired for me.

Chittagong

Confirmed, binding to localhost suppresses the dialog. – Est

Answer 2

Talked to the App Engine people on Google Groups, apparently this is fixed in the newest build of the SDK (1.8.1).

Ingeborgingelbert

Answer 3

I don't get the firewall popup when I run goapp serve, but I do get it when I run go test with anything that uses the google.golang.org/appengine/aetest package. To fix this, I needed to patch two files to force all the test servers to only listen on localhost. I submitted a pull request, so maybe this will get fixed upstream: https://github.com/golang/appengine/pull/25

$GOPATH/src/google.golang.org/appengine/internal/main_vm.go line 25; change:

if err := http.ListenAndServe(":"+port, http.HandlerFunc(handleHTTP)); err != nil {
  log.Fatalf("http.ListenAndServe: %v", err)
}

to:

host := ""
if IsDevAppServer() {
  host = "localhost"
}
if err := http.ListenAndServe(":"+port, http.HandlerFunc(handleHTTP)); err != nil {
  log.Fatalf("http.ListenAndServe: %v", err)
}

I also needed to patch $HOME/google-cloud-sdk/platform/google_appengine/lib/portpicker/portpicker/__init__.py line 79:

sock.bind(('', port))

to:

sock.bind(('localhost', port))

Chemar