46

Every time I am running Go applications on MacOs with this command:

go run main.go

I get this pop up message:

Do you want the application "main" to accept incoming network connections?

I added Go and all main executable files to Firewall Exceptions but I am still getting this pop ups. I am running out of ideas. Please can anyone help me to get rid of those pop ups? At this point I have no idea if the problem is related to Golang or MacOs.

3 Answers 3

54

You can avoid this pop-up when running local tests if you specify the host portion of the address that will be listened to to be "localhost" or "127.0.0.1". Many programs let you set the address through the command line or an environment variable and many of those programs will default to passing no host to the listen command. With no host specified, Go will listen on 0.0.0.0 and macOS will want to warn you about that. When Go opens ports on the localhost, macOS doesn't warn - at least not in my cases.

For example, instead of:

r := gin.Default()
r.Run()

you can write:

r := gin.Default()
r.Run("localhost:8080")
0
18

Thanks to the answer by @WeakPointer above, I figured all we need to do in our code is to replace:

http.ListenAndServe(":8080", nil)

by:

http.ListenAndServe("localhost:8080", nil)

or if using a library like gin-gonic, replace:

r.Run()

by:

r.Run("localhost:8080")
0
11

This is normal behaviour.

Each time you run go run main.go a new executable file is being created. This executable file is unique and unrecognised by macOS's security checks. Thus macOS asks, every time, for you to confirm if the new executable can have network access.

Build and Sign

To avoid the warning, you need to build the executable file once and codesign it. You can build the executable file using the command:

go build -o mycmd main.go

The resulting executable called mycmd can be run using:

./mycmd

To ad-hoc codesign this executable use:

codesign -s - mycmd

This will cause macOS to trust this build of mycmd on your Mac. The first time it is run, you will be asked for network access. Subsequent runs will not require network checks.

4
  • thanks, would I have to repeat that each time I change the code? Jun 12, 2020 at 13:17
  • 1
    Yes, each time you recompile the code you will need to codesign and grant the process network access. You might want to consider a small makefile or shell script to combine the go build… and codesign… commands. Jun 12, 2020 at 15:00
  • Clicking "Allow" seems easier... Jun 24, 2021 at 22:36
  • @user3621156 selecting Allow each time can affect the executable's behaviour. Servers that require network access are blocked and may fail or time out before the user can respond. Pre-signing the executable avoids this problem. Jun 25, 2021 at 9:16

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .