chromium/hstspreload

Treat IP addresses differently from normal domains

ExE-Boss opened this issue · 3 comments

ExE-Boss commented

Testing 1.1.1.1 returns that it’s a subdomain, even though it’s actually an IP address and therefore it should be preloadable.

Same happens with 1.0.0.1.

The IPv6 adresses of 2606:4700:4700::1111 and 2606:4700:4700::1001 don’t work through the web interface at all and are identified as TLDs instead.

See also:

martijnc commented

IP addresses are excluded from (dynamic) HSTS (and HPKP) and probably shouldn't be preloadable either. Maybe we should detect when an IP address is submitted and improve the error message in that case?

Chrome and Firefox also ignore (dynamic) HSTS headers when the hostname is an IP address.

  • 👍1
lgarron commented

I agree with @martijnc: we shouldn't allow automatic submissions of IPs, but we should detect them and give an appropriate message.
(In particular, the fact that dynamic HSTS isn't supported for IP addresses means that the site can't satisfy the dynamic HSTS requirements.)

However, you could see if adding it to the list directly is feasible, by contacting the current maintainers.

  • 👍1
ExE-Boss commented

Well, 1.1.1.1 and 1.0.0.1 were added in commit 5a9976b to the chromium repository, but 1.1.1.1 was removed in commit 36b8980 due to issues with broken middle‑boxes.