# Clipper API listens only localhost, requesting to include local addresses

**URL:** <https://discourse.joplinapp.org/t/clipper-api-listens-only-localhost-requesting-to-include-local-addresses/3560>\
**Category:** Features\
**Created:** [19 September 2019 18:40 UTC](https://discourse.joplinapp.org/t/clipper-api-listens-only-localhost-requesting-to-include-local-addresses/3560 "2019-09-19T18:40:16Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![kereviz](https://yyz2.discourse-cdn.com/flex028/user_avatar/discourse.joplinapp.org/kereviz/32/1418_2.png) [@kereviz](https://discourse.joplinapp.org/u/kereviz)\
**Post date:** [19 September 2019 18:40 UTC](https://discourse.joplinapp.org/t/clipper-api-listens-only-localhost-requesting-to-include-local-addresses/3560/1 "2019-09-19T18:40:16Z")

</div>

Joplin’s Clipper API is great to extend apps functionality but it only works if you are on the same machine since its only listening to localhost:41184 instead of 0.0.0.0:41184 like most apps do. I wanted to export booknotes from my e-reader but due to this limitation it’s not possible.  
It works with tcp tunnelling but that is just a workaround.

```
    State Recv-Q Send-Q Local Address:Port Peer Address:Port    
    LISTEN 0 5 0.0.0.0:8000 0.0.0.0:*       
    LISTEN 0 128 127.0.0.1:41184 0.0.0.0:*       
    LISTEN 0 5 0.0.0.0:41185 0.0.0.0:*       

```

ss -tl on my computer, first one is Python http server, second is Joplin

My proposition is making it listen on all IP’s. Implementation shouldn’t be too hard, while I’m not familiar with Javascript, its only changing numbers in Python. From security standpoint maybe it’s not good but auth token is there for a reason.

see also [https://github.com/koreader/koreader/issues/5086](https://github.com/koreader/koreader/issues/5086)

---

<div class="post-metadata">

**Author:** ![laurent](https://avatars.discourse-cdn.com/v4/letter/l/ce7236/32.png) [@laurent](https://discourse.joplinapp.org/u/laurent)\
**Post date:** [19 September 2019 21:36 UTC](https://discourse.joplinapp.org/t/clipper-api-listens-only-localhost-requesting-to-include-local-addresses/3560/2 "2019-09-19T21:36:02Z")

</div>

The auth token is meant to prevent rogue browser extensions from stealing or deleting user data, however it’s not secure enough to expose the server to internet.

---

<div class="post-metadata">

**Author:** ![kereviz](https://yyz2.discourse-cdn.com/flex028/user_avatar/discourse.joplinapp.org/kereviz/32/1418_2.png) [@kereviz](https://discourse.joplinapp.org/u/kereviz)\
**Post date:** [22 September 2019 13:16 UTC](https://discourse.joplinapp.org/t/clipper-api-listens-only-localhost-requesting-to-include-local-addresses/3560/3 "2019-09-22T13:16:32Z")

</div>

If you don’t explicitly set your router to port forwarding it’s not internet, just private network.

I’m guessing from this [topic / web clipper arthitecture](https://discourse.joplinapp.org/t/web-clipper-architecture/2331/10), it isn’t possible to making it optional or reading from a file?

---

<div class="post-metadata">

**Author:** ![laurent](https://avatars.discourse-cdn.com/v4/letter/l/ce7236/32.png) [@laurent](https://discourse.joplinapp.org/u/laurent)\
**Post date:** [22 September 2019 14:48 UTC](https://discourse.joplinapp.org/t/clipper-api-listens-only-localhost-requesting-to-include-local-addresses/3560/4 "2019-09-22T14:48:21Z")

</div>

You can change the port on the cli app but not the ip it’s listening on. I’d accept a pr which adds an argument to set the ip on cli app.

---

<div class="post-metadata">

**Author:** ![DAB](https://avatars.discourse-cdn.com/v4/letter/d/e56c9b/32.png) [@DAB](https://discourse.joplinapp.org/u/DAB)\
**Post date:** [3 December 2021 12:13 UTC](https://discourse.joplinapp.org/t/clipper-api-listens-only-localhost-requesting-to-include-local-addresses/3560/5 "2021-12-03T12:13:45Z")

</div>

This can easily be achieved using an ssh tunnel, as long as you have an SSH server somewhere on your network.

For example, on my Windows 10 machine I ran this from a WSL window (Ubuntu)

**ssh -NR 192.168.179.2:51234:localhost:41184 [user@192.168.179.2](mailto:user@192.168.179.2)**

This means that I am forwarding my local listening port 41184 to another machine, in this case 192.168.179.2, so that the remote machine now listens on port 51234.

I can now use the remote server to access all my notes.

For example,

**curl http : // 192.168.179.2:51234 / ping**  
(I had to include spaces in this URL otherwise it seems the forum won't allow me to post this message)

Of course, if I had an SSH daemon running on my Windows computer, I could also achieve the above with a local tunnel, using -L instead of -R.

(By the way, I've just started using Joplin. I'm very impressed by the software and happy to be here 🙂. As from today, I'll be saying goodbye to Evernote, which has become ridiculously bloated and is broken on Android. While I'm writing this I'm importing all my old notes.)