Dumpio

Dumpio is a local developer tool, and its defaults reflect that: servers listen on loopback only, so they aren't reachable from the network until you consciously change it yourself. This page describes every security feature.

Loopback by default

A new server binds to localhost / 127.0.0.1. In this mode:

• Only processes on the same machine can connect.
• For HTTP, a Host header anchor additionally rejects requests whose Host isn't loopback — this blocks the classic "a malicious web page silently POSTs to your local service" / DNS-rebinding attack.

Cross-origin protection (HTTP)

Legitimate SDK and curl clients never send an Origin header; browsers do. The HTTP transport therefore rejects (403) any request that carries Origin or a Sec-Fetch-Site: cross-site header. So a random web page can't use your running Dumpio as a data store.

Access token

In Settings → Security, set an Access token if you want to require authentication for every dump. An empty value means off.

• HTTP: send Authorization: Bearer <token> or X-Dumpio-Token: <token>. A missing/wrong token returns 401.
• TCP: put a "token" field inside the JSON content (a raw socket has no headers). A missing/wrong token silently drops the message.

Tokens are compared in constant time so a network attacker can't guess them byte by byte from timing. The Generate button creates a Dio- + 48 hex-character token.

Exposing a server to the network

When you switch a server's availability to Network, it binds to 0.0.0.0 and becomes reachable from your LAN. Dumpio treats this as a conscious, guarded action:

• A server bound to a non-loopback host won't start without a token — the token is the authentication factor once the port is reachable. This is enforced even if you hand-edit settings.json.
• On a network-exposed HTTP server the Host header anchor is turned off (LAN clients legitimately send the machine's IP as Host), so the token becomes the primary factor.
• Traffic is unencrypted. The in-app confirmation dialog recommends an SSH tunnel instead of direct exposure:

1ssh -L 21234:localhost:21234 user@this-machine

Then point the remote app at its own localhost:21234, tunneled to your Dumpio.

Payload size limit

Max payload size (in KB, default 1024) bounds a single request/message:

• HTTP: a body above the limit is rejected with 413 Payload too large.
• TCP: a connection whose buffer exceeds the limit is closed (preventing unbounded memory growth on a raw socket).

This is a network limit applied before parsing — it's independent of the trimming limits in rendering (see Dump format).

Rate limiting

Rate limit (messages per second, default 1000, 0 = off) is enforced per client/connection with a fixed one-second window:

• HTTP: requests above the limit get 429 Rate limit exceeded.
• TCP: messages above the limit are dropped.

Changes take effect immediately — the limiter reads the live value, so you don't need to restart the server after a change.

Ports and collisions

Two running servers can't share the same host:port; the second is rejected (EADDRINUSE / "Port already in use"). Changing a server's host/port/protocol restarts its transport with a short delay so the port is released.

What leaves your machine

By default, nothing. Dumps are received locally, held in memory, and optionally saved to a local file. The only outbound calls Dumpio makes are the ones you trigger yourself: opening an external URL (http/https only) or a file in the editor (restricted to a known list of editor schemes). Everything else stays on the machine.