http: match subdomains for plain NO_PROXY entries - #65617
Open
dibenkobit wants to merge 5 commits into
Open
Conversation
NO_PROXY=example.com only exact-matched the hostname in the http(s) builtins, so requests to subdomains still used the proxy. fetch() already matches the host and its subdomains. Reuse the existing suffix matcher (label boundary) for plain entries as well as leading-dot ones. Fixes: nodejs#65616 Assisted-by: Grok 4.6 Extra High Signed-off-by: Nikita Snetkov <lukyanish@gmail.com>
Collaborator
|
Review requested:
|
nodejs-github-bot
added
http
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #65617 +/- ##
==========================================
- Coverage 90.07% 90.06% -0.01%
==========================================
Files 751 751
Lines 254916 254918 +2
Branches 48133 48129 -4
==========================================
- Hits 229605 229588 -17
- Misses 16496 16498 +2
- Partials 8815 8832 +17
🚀 New features to boost your workflow:
|
inoway46
reviewed
Aug 30, 2026
| const suffix = entry.substring(1); | ||
| // Strip a leading "." if present, then match as a suffix with a | ||
| // label boundary. "*.example.com" is handled below (subdomains only). | ||
| if (!entry.startsWith('*.')) { |
Contributor
There was a problem hiding this comment.
Could we limit suffix matching to domain entries?
As written, NO_PROXY=127.0.0.1 also bypasses foo.127.0.0.1, although IP entries are documented as exact matches. Empty entries from trailing commas can also match hostnames ending in a dot.
Author
There was a problem hiding this comment.
Updated in the latest fixup to keep the change scoped to plain entries:
- The new suffix match ignores empty entries, so an empty entry from a
trailing comma cannot match a hostname ending in a dot. - It only applies when both the entry and request host are not IP
literals, soNO_PROXY=127.0.0.1does not matchfoo.127.0.0.1.
Existing leading-dot and wildcard behavior is unchanged. Both cases are
covered by regression tests.
inoway46
reviewed
Aug 30, 2026
|
|
||
| // The request should go through the proxy (not bypass it), | ||
| // because badexample.com is not a subdomain of example.com. | ||
| assert.match(stdout, /Status Code: 200/); |
Contributor
There was a problem hiding this comment.
This test seems to pass whether the proxy is used or bypassed, since both paths reach the same server. Could we also assert that the custom lookup for badexample.com was not used?
For example:
assert.doesNotMatch(
stdout,
/Resolving lookup for badexample\.com/,
);
Author
There was a problem hiding this comment.
Added it to all three negative blocks
Limit NO_PROXY suffix matching to domain entries and domain hosts: - drop empty entries (e.g. from trailing commas) at parse time, so they can no longer match hostnames ending with a dot - IP entries only match a host exactly; IP hosts can only be bypassed by exact IP, IP:port, or IP range entries - degenerate "." and "*." entries no longer match every host ending with a dot Assisted-by: Claude Fable 5 Signed-off-by: Nikita Snetkov <lukyanish@gmail.com>
Assert that the negative NO_PROXY domain tests actually go through the proxy: both paths return 200 from the same server, so assert on the absence of the custom lookup log line instead. Assisted-by: Claude Fable 5 Signed-off-by: Nikita Snetkov <lukyanish@gmail.com>
Reword the NO_PROXY IP-matching note: the previous wording contradicted the IP range and host:port forms listed above it. Assisted-by: Claude Fable 5 Signed-off-by: Nikita Snetkov <lukyanish@gmail.com>
dibenkobit
marked this pull request as draft
September 1, 2026 12:45
dibenkobit
force-pushed
the
http-no-proxy-suffix
branch
from
September 1, 2026 12:57
af34dc3 to
8af581d
Compare
Keep the change scoped to plain domain entries. Preserve the existing leading-dot and wildcard behavior, while preventing the new suffix match from applying to empty entries or IP literals. Signed-off-by: Nikita Snetkov <lukyanish@gmail.com>
dibenkobit
force-pushed
the
http-no-proxy-suffix
branch
from
September 1, 2026 13:44
8af581d to
09d37d4
Compare
dibenkobit
marked this pull request as ready for review
September 1, 2026 13:44
13 tasks
mcollina
reviewed
Sep 1, 2026
| @@ -4615,7 +4619,7 @@ Proxy URLs can use either HTTP or HTTPS protocols: | |||
| The `NO_PROXY` environment variable supports several formats: | |||
|
|
|||
| * `*` - Bypass proxy for all hosts | |||
| * `example.com` - Exact host name match | |||
| * `example.com` - Host and subdomain match (matches `sub.example.com`) | |||
| * `.example.com` - Domain suffix match (matches `sub.example.com`) | |||
Member
There was a problem hiding this comment.
This would make example.com and .example.com match. This does not seem something we might want to do
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
NO_PROXY=example.comonly exact-matched the hostname in thehttp/httpsbuilt-ins, so requests to subdomains still used the proxy.Make plain domain entries match the host and its subdomains, as
fetch()already does, while preserving a label boundary.
The new plain-entry suffix match ignores empty entries and only applies
when both the entry and request host are not IP literals. Existing
leading-dot and wildcard behavior is unchanged.
Fixes: #65616
Refs: #57872
Assisted-by: Grok 4.6 Extra High
Assisted-by: Fable 5
cc @nodejs/http