[Bug]: Cannot add podcast with localhost URL #1710

Closed
opened 2026-04-24 23:55:40 +02:00 by adam · 2 comments
Owner

Originally created by @BradleyMarie on GitHub (Feb 4, 2024).

Describe the issue

I'm attempting to add a podcast by URL where the http server hosting the RSS feed is served on localhost. When I do this, I receive an error back from the server "Podcast RSS feed request failed or invalid response data". I also looked at the server logs and observed the following:

ERROR: [podcastUtils] getPodcastFeed Error AxiosError: Call to 127.0.0.1 is blocked.

Based on some chatter I found here, I believe the issue is that Axios is not configured to allow connections to localhost, but I'm also entirely unfamiliar with Node.js.

Steps to reproduce the issue

  1. Add a podcast where the RSS feed is served on localhost

Audiobookshelf version

v2.7.2

How are you running audiobookshelf?

Docker

Originally created by @BradleyMarie on GitHub (Feb 4, 2024). ### Describe the issue I'm attempting to add a podcast by URL where the http server hosting the RSS feed is served on localhost. When I do this, I receive an error back from the server "Podcast RSS feed request failed or invalid response data". I also looked at the server logs and observed the following: ```ERROR: [podcastUtils] getPodcastFeed Error AxiosError: Call to 127.0.0.1 is blocked.``` Based on some chatter I found [here](https://stackoverflow.com/questions/49529201/node-js-axios-wont-connect-to-localhost), I believe the issue is that Axios is not configured to allow connections to localhost, but I'm also entirely unfamiliar with Node.js. ### Steps to reproduce the issue 1. Add a podcast where the RSS feed is served on localhost ### Audiobookshelf version v2.7.2 ### How are you running audiobookshelf? Docker
adam added the bug label 2026-04-24 23:55:40 +02:00
adam closed this issue 2026-04-24 23:55:41 +02:00
Author
Owner

@advplyr commented on GitHub (Feb 4, 2024):

Due to the security advisory submitted here https://github.com/advplyr/audiobookshelf/security/advisories/GHSA-mgj7-rfx8-vhpr I added an SSRF request filter. https://github.com/y-mehta/ssrf-req-filter

That validates the path being entered is external.

@advplyr commented on GitHub (Feb 4, 2024): Due to the security advisory submitted here https://github.com/advplyr/audiobookshelf/security/advisories/GHSA-mgj7-rfx8-vhpr I added an SSRF request filter. https://github.com/y-mehta/ssrf-req-filter That validates the path being entered is external.
Author
Owner

@BradleyMarie commented on GitHub (Feb 4, 2024):

Thanks for the quick reply. It sounds like this is working as intended and is not a bug.

It would be nice to be able to add local feeds directly, but I am able to workaround this by behavior by bouncing the request off my router.

I'll close this issue out. Thanks!

@BradleyMarie commented on GitHub (Feb 4, 2024): Thanks for the quick reply. It sounds like this is working as intended and is not a bug. It would be nice to be able to add local feeds directly, but I am able to workaround this by behavior by bouncing the request off my router. I'll close this issue out. Thanks!
Sign in to join this conversation.
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/audiobookshelf#1710