The documentation on the listen method is really vague, but the way you can make your server listen to an specific address only is this:
var server = app.listen(3000, '127.0.0.1', 511, onServerListening);
In this case I want the server to respond only to connections using the 127.0.0.1 host name. Not 0.0.0.0, and not localhost. Only 127.0.0.1.
The reason for this is that I am playing with Twitter's OAuth and I was stumbling upon this issue because express insisted in binding to 0.0.0.0 by default (i.e. any address), but it wouldn't work well when Twitter redirected back after authenticating.
For reference, another thing I tried and didn't work:
var server = app.listen(3000, '127.0.0.1', onServerListening);
Notice that the 511 parameter is missing. So effectively it would take onServerListening as if it was the 511 parameter, which according to the documentation is "the maximum length of the queue of pending connections" and it wouldn't call the callback. Booo.