镜像站点 · 本页由第三方 GitHub 只读镜像提供,非 GitHub 官方站点,不接受任何登录或凭据输入。前往 github.com
Skip to content

Localhost is not allowed, even when allowPrivateAddress is true #1302

Description

@galaxor

Hi. I'm trying to run a test of my onFollow listener. I'm trying to have the onFollow function do follow.getActor(), where the actor is at http://localhost:9999/users/Bob. I feel like that should be allowed, because this is happening within a Federation that I created allowPrivateAddress set to true. But even so, I'm getting UrlError: Localhost is not allowed at the point where I try to call getActor.

Have I not properly allowed private address?

Here's what I'm doing.

import { createFederation } from "@fedify/testing";
import { Follow } from "@fedify/vocab";
import { type Context } from "@fedify/fedify";
    
      
const test_federation = createFederation({ contextData: {}, allowPrivateAddress : true });
const inboxListener = test_federation.setInboxListeners("/@{identifier}/inbox", "/inbox");
inboxListener.on(Follow, onFollow);
    
export async function onFollow(ctx: Context, follow: Follow) {
    const followerActor = follow.getActor();
}     

let the_follow = new Follow({
  id: new URL(`http://localhost:9999/activities/Alicia/follow-alice`),
  actor: new URL(`http://localhost:9999/users/Alicia`),
  object: new URL("https://local.example/users/Alice"), 
});

await test_federation.receiveActivity(the_follow);

Now, I tracked this down a little bit. I'm sorry I don't have a proper reference to the real source code, but I'm using fedify/fedify 2.4.4. In my node_modules/vocab/dist/mod.js, there's a function called async #fetchActor(url, options = {}) . The first line of that function is this:

                const documentLoader = options.documentLoader ?? this._documentLoader ?? getDocumentLoader();

and I have confirmed that neither options.documentLoader nor this._documentLoader is set, and it's calling getDocumentLoader with no parameters. That means that it doesn't have the allowPrivateAddress set, so it's not actually looking at what I set when I created the Federation.

Am I doing something wrong, or should it in fact be looking that up? Perhaps there's something I need to do in order to make it so that options.documentLoader or this._documentLoader will be set at this point? I apologize that my only source code reference is in the object code. I can try later to track that down in the source.

Thanks.

Activity

  1. added theissue type on Oct 17, 2026
  2. dahlia commented on Oct 17, 2026

    @dahlia
    Member

    Thanks for the report! This looks like a bug in @fedify/testing. I reproduced it on 2.0-maintenance, so the fix should target that branch.

  3. self-assigned this
    on Oct 19, 2026
  4. changed the title [-]Localhost is not allowed, even when allowPrivateAddress is true[/-] [+]Localhost is not allowed, even when `allowPrivateAddress` is `true`[/+] on Oct 19, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

component/testingTesting utilities (@fedify/testing)

Type

Fields

Priority

None yet

Effort

None yet

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions