How do I get ASP.NET Web API (self-hosted) to listen on *only* localhost?

Question

I'm following the example here for a self-hosted ASP.NET Web API service. However, when specifying "localhost" as the host in the base address, it is translated to "+" (meaning "all available").

var baseAddress = new Uri("http://localhost:13210");
var configuration = new HttpSelfHostConfiguration(baseAddress);
configuration.Routes.MapHttpRoute(
    name: "DefaultApi",
    routeTemplate: "{controller}/{id}",
    defaults: new {id = RouteParameter.Optional});

using (var server = new HttpSelfHostServer(configuration))
{
    server.OpenAsync().Wait();
    stop.WaitOne();
    server.CloseAsync().Wait();
}

I really do want my host bound to just "localhost" -- it will only be accessed from the same machine, and I don't want to mess around with URL ACLs.

How do I configure Web API to not rewrite "localhost" to "+"?

Answer 1

Set your HostNameComparisonMode property to Exact:

var config = new HttpSelfHostConfiguration("https://localhost/api/");
config.HostNameComparisonMode = HostNameComparisonMode.Exact;

See this article for more information on HostNameComparisonMode