From c399a172d4e0ae67aeabf742e11210fb9b309d85 Mon Sep 17 00:00:00 2001
From: mohammed arib <arib@bugqore.com>
Date: Thu, 8 Oct 2026 17:27:16 +0530
Subject: [PATCH] bind local callback server to configured host not all
 interfaces

---
 .../auth/oauth2/LocalServerReceiver.java      |  2 +-
 .../auth/oauth2/LocalServerReceiverTest.java  | 22 +++++++++++++++++++
 2 files changed, 23 insertions(+), 1 deletion(-)

diff --git a/google-oauth-client-jetty/src/main/java/com/google/api/client/extensions/jetty/auth/oauth2/LocalServerReceiver.java b/google-oauth-client-jetty/src/main/java/com/google/api/client/extensions/jetty/auth/oauth2/LocalServerReceiver.java
index fc7869667..9d7f448c4 100644
--- a/google-oauth-client-jetty/src/main/java/com/google/api/client/extensions/jetty/auth/oauth2/LocalServerReceiver.java
+++ b/google-oauth-client-jetty/src/main/java/com/google/api/client/extensions/jetty/auth/oauth2/LocalServerReceiver.java
@@ -124,7 +124,7 @@ public LocalServerReceiver() {
   @Override
   public String getRedirectUri() throws IOException {
 
-    server = HttpServer.create(new InetSocketAddress(port != -1 ? port : findOpenPort()), 0);
+    server = HttpServer.create(new InetSocketAddress(host, port != -1 ? port : findOpenPort()), 0);
     HttpContext context = server.createContext(callbackPath, new CallbackHandler());
     server.setExecutor(null);
 
diff --git a/google-oauth-client-jetty/src/test/java/com/google/api/client/extensions/jetty/auth/oauth2/LocalServerReceiverTest.java b/google-oauth-client-jetty/src/test/java/com/google/api/client/extensions/jetty/auth/oauth2/LocalServerReceiverTest.java
index ec3c03eda..7e3a2fa48 100644
--- a/google-oauth-client-jetty/src/test/java/com/google/api/client/extensions/jetty/auth/oauth2/LocalServerReceiverTest.java
+++ b/google-oauth-client-jetty/src/test/java/com/google/api/client/extensions/jetty/auth/oauth2/LocalServerReceiverTest.java
@@ -21,10 +21,13 @@
 import static org.junit.Assert.assertTrue;
 
 import com.google.common.io.CharStreams;
+import com.sun.net.httpserver.HttpServer;
 import java.io.IOException;
 import java.io.InputStreamReader;
 import java.io.Reader;
+import java.lang.reflect.Field;
 import java.net.HttpURLConnection;
+import java.net.InetSocketAddress;
 import java.net.URL;
 import java.nio.charset.StandardCharsets;
 import org.junit.Test;
@@ -44,6 +47,25 @@ public void testActualPort() throws IOException {
     }
   }
 
+  @Test
+  public void testServerBindsToLoopback() throws IOException, ReflectiveOperationException {
+    LocalServerReceiver receiver = new LocalServerReceiver();
+
+    try {
+      receiver.getRedirectUri();
+      Field serverField = LocalServerReceiver.class.getDeclaredField("server");
+      serverField.setAccessible(true);
+      HttpServer server = (HttpServer) serverField.get(receiver);
+      InetSocketAddress bound = server.getAddress();
+      assertFalse(
+          "callback server must not listen on all interfaces",
+          bound.getAddress().isAnyLocalAddress());
+      assertTrue(bound.getAddress().isLoopbackAddress());
+    } finally {
+      receiver.stop();
+    }
+  }
+
   @Test
   public void testRedirectUri() throws IOException {
     LocalServerReceiver receiver = new LocalServerReceiver("localhost", -1, null, null);