DataMind Oda serves its web app to a browser on this computer, and it checks the address of every request before Oda handles it: a request must carry a local address, or one you have added as a trusted host. This page covers that check, which names count as local, how trusted hosts are written and matched, and what a refused request looks like. Opening and signing in are on The Oda web app; starting the browser surface is on Oda in the browser.
Every request the web app sends to your own Oda passes the check before Oda does anything with it.
null as its origin is refused as well.The address check is not the sign-in. The check decides which addresses may talk to the web app; the sign-in decides whether a browser may use it. Both must pass before a request is handled, and neither replaces the other.
These are accepted with no setup at all:
| Address | Counts as local |
|---|---|
localhost | Yes |
[::1], the IPv6 loopback | Yes |
Any address in 127. | Yes |
remote. | No, it is a different name that only looks local |
128. | No, it is outside the 127. range |
Everything else is refused until you add it as a trusted host.
When you reach the web app under a name other than its local address, such as one from a forwarding or proxy setup, add that name as a trusted host. The web app takes trusted hosts through the --trusted-host option; Oda in the browser covers starting the surface and the option itself.
A trusted host is written as exactly the address you use:
laptop.. It is trusted on every port.laptop.. Only that port is trusted.Matching is exact, with both sides compared in the standard browser spelling of an address: the case of the letters does not matter, and a redundant standard port changes nothing.
An entry must be nothing but the name, or the name and port. Anything else is refused when the web app starts, rather than quietly ignored: a path after the name, a username, stray spaces, a trailing colon, a port with a leading zero, or a spelling of an address that is not its plain form. The failure names the entry.
The web app is not served to the whole network: a start that binds every network interface is refused. A trusted host is the supported way to use the app under another name.
| What happened | What comes back |
|---|---|
| The address check failed | Status 403 |
| The address is fine, but the browser has no working sign-in | Status 401, before Oda handles the request |
| The address is not one the web app serves | Status 404 |
The exact words for these answers are listed in Connection and upload messages, together with the messages your browser's developer tools show.
The web app serves one person: you, at this computer. It has no accounts or roles of its own, so every request it accepts speaks for the same person, and a browser that signs in acts as you. That is why it belongs on this computer, or on a network you trust.
localhost, the IPv6 loopback [::1], and any address in the 127. range. Everything else needs a trusted host entry, and a name that only resembles a local address, such as remote., is not treated as local.
No. Local addresses are always accepted. A trusted host is only for reaching the web app under another name.
No. A request that is marked as coming from another site is refused even when its address is local, and a request whose origin is not the address it asks for is refused too. That is what protects the web app from pages on other sites.
A request with no browser markers, such as one from a command-line tool, is judged by its address alone: a local address passes the address check. The sign-in still applies, so the tool needs a working browser sign-in before its requests are handled.
No. The address check decides which addresses may talk to the web app; the sign-in decides whether a browser may use it. Both must pass. The Oda web app covers opening and signing in.
The check looks at the name a request carries, not where it leads, so a name that is not local is refused until it is trusted. Add that name, or the name and port, as a trusted host; Oda in the browser covers the option that does it.
403 and 401?403 means the address check failed: the request did not come from a local or trusted address, or it came from another site. 401 means the address was fine, but the browser has no working sign-in; it is answered before Oda handles the request. Connection and upload messages lists both.
An entry must be exactly a name, or a name and port, nothing else. A path after the name, a username, stray spaces, a trailing colon, a port with a leading zero, or an address in a non-standard spelling is refused, and the failure names the entry. Rewrite the entry in its plain form and start again.
No. It serves one person, and every request it accepts speaks for the person at this computer; there is no separate account to give someone else. Keep the web app on this computer, or on a network you trust.