is-loopback-addr

is-loopback-addr

Check if a IP address is a loopback address

Various Internet Engineering Task Force (IETF) standards reserve the IPv4 address block 127.0.0.0/8 and the IPv6 address ::1/128 for this purpose. The most common IPv4 address used is 127.0.0.1. Commonly these loopback addresses are mapped to the hostnames, localhost or loopback. For more information check rfc5735 and rfc3513.

This checks whether a string is a loopback address literal, per 127.0.0.0/8 and ::1/128. It accepts any spelling the platform URL parser canonicalises into those ranges, which includes 127.1, 2130706433, 0x7f000001 and 0177.0.0.1. Hostnames are never resolved: localhost is false, and ::ffff:127.0.0.1 is false because it is in neither range.

This is not an SSRF filter. It classifies literals by RFC range. It does not know about DNS, redirects, IPv4-mapped addresses or any other route to the loopback interface, and it should not be the only check between untrusted input and an outbound request.

Install

npm i is-loopback-addr

Usage

import { isLoopbackAddr } from 'is-loopback-addr'

console.log(isLoopbackAddr('127.0.0.1')) // true
console.log(isLoopbackAddr('192.168.0.1')) // false
console.log(isLoopbackAddr('22.2.0.1')) // false
console.log(isLoopbackAddr('::1')) // true
console.log(isLoopbackAddr('2001:8a0:7ac5:4201:3ac9:86ff:fe31:7095')) // false

Contribute

Feel free to dive in! Open an issue or submit PRs.

License

MIT Vasco Santos