I am a programmer but I am currently learning about web development in general. I'm creating a server on my local host using nodejs and express. It's available on my local host but I want to test it with a domain I have, so I can access it from any device anywhere.

What I decided to do was change my router settings to direct any traffic it gets on its IP to my computers internal IP on port 3000 so anyone can access the my html pages from my local machine. This was working quite well.

But after some hours of working Bitdefender Antivirus alerted that It blocked some attacks from a specific IP on port 3000. This lead me to question how safe It was to be doing this. The server is running on my home machine that has my regular files and documents.

Of course I'm only serving the html pages for the site but can someone kindly explain the security implications of using your regular home router as a server as opposed to a dedicated server or a web hosting service.

Note 1: I'm not interested in other aspects such as bandwidth since that's not going to be a problem.

Note 2: Also I'm using Netlify's free web hosting right now as an alternate (or instead of the alternate) but it's god awfully slow to load my simplest html page. It takes a while (inconsistent as well) before the browser can even resolve the domain and then loads the content progressively slowly ( I mean you see things like the main image slowly reveal). when using my own router it's blazingly fast; not just on my local machine

  • Free hosting is always slow. A cheap VPS can be rented for as little as a dollar...
    – ThoriumBR
    Commented Jul 17, 2020 at 17:29
  • 1
    I think you are confused about the term router and server. Your router does not act as a (web)server in this scenario, it merely routes the incoming traffic to your local machine. Your local machine is running the webserver. Commented Jul 17, 2020 at 17:38
  • @roy.stultiens Yes... thank you, I understand that. I'm just abstracting that concept of server to mean my router routing traffic to my local machine.
    – BrianO
    Commented Jul 17, 2020 at 18:42

2 Answers 2


Like everything, it is partly safe and partly risky.

It's safe because your application is the only thing other people can get access to.

It's also unsafe because other people can get access to your application.

If there's a security bug in your application, it might allow people to get access to things they're not supposed to access.

You say that your application only serves HTML files. There's not much that can go wrong in that case, but I can still think of one thing. If I (a web browser) ask your application for /index.html, I guess it will send me the file C:\Users\Brian\Documents\apps\test\index.html. What happens if I ask for ../../credit card.txt? Will it send me C:\Users\Brian\Documents\apps\test\..\..\credit card.txt a.k.a. C:\Users\Brian\Documents\credit card.txt? If it does, that is called a directory traversal attack. Maybe I can get your browser history and passwords that way. But if it just sends me a 404 page, then it's fine.

(Note: you couldn't test this just by going to http://localhost:3000/../../credit card.txt in a web browser - the browser will change it to http://localhost:3000/credit card.txt)

If you're confident that your program doesn't have any security bugs, then go ahead and open it up. If you're not confident, then don't.

  • Thanks. I agree. the server doesn't seem to have any vulnerabilities like these but I'll still go with the safer option and maybe rent a web server.
    – BrianO
    Commented Jul 18, 2020 at 0:30
  • @BrianO Well, it's up to you. It's not automatically safe and it's not automatically unsafe. Commented Jul 18, 2020 at 11:27

It is not safe.

Simply port forwarding internet traffic to an application running in your local network essentially exposes your full internal network to some attacker in case of a bug in the application. And bugs are likely. If the server application is instead located at some hosting provider on the public internet it will not have access to your internal network.

If it is only about testing your application from outside or providing access to a few selected users you should at least add strong authentication with some proven setups, for example by using nginx as a reverse proxy. Or you could use solutions like ngrok for a more limited exposure of your internal application to the internet. You could also put the application into some container or VM with appropriate firewall rules so that it cannot access the internal network.

  • when you say not safe.. can you clarify. how is it any less secure than an actual server. my machine should only be serving the pages I want served.
    – BrianO
    Commented Jul 17, 2020 at 18:44
  • @BrianO: "my machine should only be serving the pages I want served." - what it should do and what it actually does might be different. Bugs in web applications are pretty common. If you have an "actual server" (you probably mean something hosted at the hosting provider) it will not have access to your internal network - but your internally hosted server application will. This means the impact of a security bug in your application is much worse. Commented Jul 17, 2020 at 18:55
  • I see this makes sense. I think I'll play It safe and just use web hosting.
    – BrianO
    Commented Jul 18, 2020 at 0:29

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .