spring-projects / spring-projects/spring-security
ipv6/ipv4 in IpAddressMatcher
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 9.6k
- Forks
- 6.3k
- Avg merge
- 2d 11h
- Merged PRs (30d)
- 52
Description
Summary
The IpAddressMatcher does not support ipv6/ipv4 translation.
I want to match the localhost using 127.0.0.1 in ipv4 or ::1 in ipv6.
Now I have find out if my server has already migrated to use ipv6 or not.
I am using this in combination with WebSecurityExpressionRoot.hasIpAddress(), I want to secure an endpoint to be only accessible on localhost.
Actual Behavior
ip address ::1 does not match 127.0.0.1.
Expected Behavior
ip address ::1 matches 127.0.0.1.
Version
latest
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by locating IpAddressMatcher and the WebSecurityExpressionRoot.hasIpAddress() entry point to understand how IPv4 and IPv6 addresses are currently compared. Reproduce the ::1 versus 127.0.0.1 case, then add coverage showing that both representations match and run the relevant security tests.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java, spring
- Domain
- security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 50/100