search

w3c / webappsec-mixed-content

WebAppSec Mixed Content
https://w3c.github.io/webappsec-mixed-content/
Other
12 stars 22 forks source link

Clarify behaviour for public IP addresses #62

Closed paulsemel closed 1 year ago

paulsemel commented 1 year ago

This clarifies the behaviour when handling literal IP addresses in requests.

paulsemel commented 1 year ago

@annevk @carlosjoan91 I cannot add you as reviewers here, but I'd definitely like you to review this PR if you have some time! 😄

annevk commented 1 year ago

What does "is a literal IP address" mean? A URL by definition is not an IP address. Do you mean to check that its host is an IP address? It would help if this suitable referenced the terms defined in the URL Standard.

Same questions are applicable to the second change. For that we might have to define what a loopback IP address is somewhere I suppose.

paulsemel commented 1 year ago

Thanks for reviewing!

What does "is a literal IP address" mean? A URL by definition is not an IP address. Do you mean to check that its host is an IP address? It would help if this suitable referenced the terms defined in the URL Standard.

I cross-referenced with the actual IP address definition, so that it makes things clearer. Same for the host.

Same questions are applicable to the second change. For that we might have to define what a loopback IP address is somewhere I suppose.

I added a definition of a non loopback IP address. I first wanted to add both loopback IP address and non loopback IP address definitions, but I figured out we only cared about the CIDR parts, so not adding too much avoids making things less clear I think...