At the moment, RemoteAgent's server can only be bound to "localhost". We should lift this restriction.

RemoteAgent's host comes from:
https://searchfox.org/mozilla-central/rev/8e1eb5cbd89a2455c34032d921f8de28261d016b/remote/components/RemoteAgent.jsm#73-77

  get host() {
    // Bug 1675471: When using the nsIRemoteAgent interface the HTTPd server's
    // primary identity ("this.server.identity.primaryHost") is lazily set.
    return this.server?._host;
  }

this.server is the instance of httpd.js used by RemoteAgent. The _host of httpd.js is set when listen is called. The call site from RemoteAgent is at https://searchfox.org/mozilla-central/rev/8e1eb5cbd89a2455c34032d921f8de28261d016b/remote/components/RemoteAgent.jsm#259-264 :

        try {
          let address = Services.io.newURI(`http://localhost:${this._port}`);
          await this.listen(address);
        } catch (e) {
          throw Error(`Unable to start remote agent: ${e}`);
        }

As you can see, localhost here is hardcoded. The only call site where RemoteAgent.listen is called with a custom URL is the test remote/cdp/test/browser/component/browser_agent.js

The goal of this bug is to make the host configurable.
We should decide how this will be configured, eg. command line argument?

We should also consider what to do about remote.force-local. For instance, DevTools is using a similar preference, but when set to true, we listen on 0.0.0.0 instead of 127.0.0.1. It seems that remote.force-local could be redundant if we allow to set a custom host?

Note that in Bug 1750689 we add a WebSocketHandshake validation logic which depends on the RemoteAgent host. Given the current limitation, we will only be able to test the localhost scenario. Might have to expand the tests added in Bug 1750689 once this is fixed.

Might flag as Inactive after Bug 1759998 lands

As discussed there are no plans at the moment to let httpd.js bind to other addresses as localhost for now.