change the default value of blockLocalAddresses

README.md

@@ -159,6 +159,14 @@ named [Semeru](https://developer.ibm.com/languages/java/semeru-runtimes/download
 This is the JVM used in
 the [Docker image](https://github.com/Athou/commafeed/blob/master/commafeed-server/src/main/docker/Dockerfile.jvm).
 
+## FAQ
+
+### Getting "Access to local address blocked" when adding a feed
+
+CommaFeed blocks access to local resources by default to prevent [SSRF](https://en.wikipedia.org/wiki/Server-side_request_forgery) attacks.
+If you want to subscribe to feeds that are only available on your local network, you can disable this security measure by setting the `commafeed.http-client.block-local-addresses` variable to `false`.
+Do this only if you trust all users of your CommaFeed instance not to access private resources.
+
 ## Translation
 
 Files for internationalization are

commafeed-server/src/main/docker/README.md

@@ -93,3 +93,12 @@ Tags are of the form `<version>-<database>[-jvm]` where:
     - `master` (always points to the latest git commit)
 - `<database>` is the database to use (`h2`, `postgresql`, `mysql` or `mariadb`)
 - `-jvm` is optional and indicates that CommaFeed is running on a JVM, and not compiled natively.
+
+## FAQ
+
+### Getting "Access to local address blocked" when adding a feed
+
+CommaFeed blocks access to local resources by default to prevent [SSRF](https://en.wikipedia.org/wiki/Server-side_request_forgery) attacks.
+If you want to subscribe to feeds that are only available on your local network, you can disable this security measure by setting the `COMMAFEED_HTTP_CLIENT_BLOCK_LOCAL_ADDRESSES` variable to `false`.
+Do this only if you trust all users of your CommaFeed instance not to access private resources.
+

commafeed-server/src/main/java/com/commafeed/CommaFeedConfiguration.java

@@ -130,7 +130,7 @@ public interface CommaFeedConfiguration {
          * <p>You may want to enable this if you host a public instance of CommaFeed with
          * registrations open.
          */
-        @WithDefault("false")
+        @WithDefault("true")
         boolean blockLocalAddresses();
 
         /** HTTP client cache configuration */