I'm trying to set a sensible secure default for a server application. I want out of the box the server to only bind to the loopback interface. The user can then make their own decision to open it up to more interfaces by changing the default.
I can bind to 127.0.0.1 to get IPv4, or I can bind to ::1 to get IPv6 but I can't seem to find a way to get both.
If I don't care about just limiting it to the loopback interface I can bind to :: which will bind to all addresses on all interfaces, but this is not a "secure by default" approach.
I can't just bind to localhost because from NodeJS v17 onward it will default to preferring IPv6 (or which ever is returned first by the resolver)