morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 07:47:29 +00:00

[GH-ISSUE #186] BrowserObservationService classifies IPv6 loopback ::1 as external #131

New issue

Closed

opened 2026-10-15 18:21:26 +00:00 by bsakaguchi · 1 comment

bsakaguchi commented

2026-10-15 18:21:26 +00:00

Owner

Originally created by @morluto on GitHub (Jul 14, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/186

Problem

browserNetworkScope in src/application/BrowserObservationService.ts uses new URL(origin).hostname === "[::1]" when deciding if all allowed origins are loopback. For IPv6 loopback URLs like http://[::1]:8080, URL.hostname returns ::1 (without brackets), so this check fails and scope resolves to external.

Repro

Configure REA_BROWSER_OBSERVE_ALLOWED_ORIGINS="http://[::1]:9222".
Trigger browser observation with an allowed IPv6 loopback origin.
The browser observation path treats the origin scope as external and may reject local-only behavior.

Expected

IPv6 loopback values should be treated as loopback consistently with existing behavior for 127.0.0.1 and ::1.

Actual

IPv6 loopback is considered external due to bracketed hostname comparison.

Note

There is an existing related issue for config parsing at #183 (parseConfig/browserNetworkScope) with the same root cause pattern; this issue tracks the application-layer duplicate path.

Originally created by @morluto on GitHub (Jul 14, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/186 ### Problem `browserNetworkScope` in `src/application/BrowserObservationService.ts` uses `new URL(origin).hostname === "[::1]"` when deciding if all allowed origins are loopback. For IPv6 loopback URLs like `http://[::1]:8080`, `URL.hostname` returns `::1` (without brackets), so this check fails and scope resolves to `external`. ### Repro - Configure `REA_BROWSER_OBSERVE_ALLOWED_ORIGINS="http://[::1]:9222"`. - Trigger browser observation with an allowed IPv6 loopback origin. - The browser observation path treats the origin scope as external and may reject local-only behavior. ### Expected IPv6 loopback values should be treated as loopback consistently with existing behavior for `127.0.0.1` and `::1`. ### Actual IPv6 loopback is considered external due to bracketed hostname comparison. ### Note There is an existing related issue for config parsing at `#183` (`parseConfig/browserNetworkScope`) with the same root cause pattern; this issue tracks the application-layer duplicate path.

bsakaguchi

2026-10-15 18:21:26 +00:00

closed this issue
added the
area: runtime

enhancement
labels

bsakaguchi commented

2026-10-15 18:21:28 +00:00

Author

Owner

@morluto commented on GitHub (Jul 17, 2026):

Implemented on main by the same shared IPv6 loopback fix as #183. BrowserObservationService now delegates to isLiteralLoopbackHostname, which recognizes ::1 and [::1].

@morluto commented on GitHub (Jul 17, 2026): Implemented on main by the same shared IPv6 loopback fix as #183. BrowserObservationService now delegates to isLiteralLoopbackHostname, which recognizes ::1 and [::1].

bsakaguchi added

enhancement

and removed

enhancement

labels

2026-10-31 00:28:45 +00:00

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#131

No description provided.

Rows
Columns