You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
Localhost is not allowed, even when allowPrivateAddress is true #1302
Hi. I'm trying to run a test of my onFollow listener. I'm trying to have the onFollow function do follow.getActor(), where the actor is at http://localhost:9999/users/Bob. I feel like that should be allowed, because this is happening within a Federation that I created allowPrivateAddress set to true. But even so, I'm getting UrlError: Localhost is not allowed at the point where I try to call getActor.
Have I not properly allowed private address?
Here's what I'm doing.
import { createFederation } from "@fedify/testing";
import { Follow } from "@fedify/vocab";
import { type Context } from "@fedify/fedify";
const test_federation = createFederation({ contextData: {}, allowPrivateAddress : true });
const inboxListener = test_federation.setInboxListeners("/@{identifier}/inbox", "/inbox");
inboxListener.on(Follow, onFollow);
export async function onFollow(ctx: Context, follow: Follow) {
const followerActor = follow.getActor();
}
let the_follow = new Follow({
id: new URL(`http://localhost:9999/activities/Alicia/follow-alice`),
actor: new URL(`http://localhost:9999/users/Alicia`),
object: new URL("https://local.example/users/Alice"),
});
await test_federation.receiveActivity(the_follow);
Now, I tracked this down a little bit. I'm sorry I don't have a proper reference to the real source code, but I'm using fedify/fedify 2.4.4. In my node_modules/vocab/dist/mod.js, there's a function called async #fetchActor(url, options = {}) . The first line of that function is this:
and I have confirmed that neither options.documentLoader nor this._documentLoader is set, and it's calling getDocumentLoader with no parameters. That means that it doesn't have the allowPrivateAddress set, so it's not actually looking at what I set when I created the Federation.
Am I doing something wrong, or should it in fact be looking that up? Perhaps there's something I need to do in order to make it so that options.documentLoader or this._documentLoader will be set at this point? I apologize that my only source code reference is in the object code. I can try later to track that down in the source.
changed the title [-]Localhost is not allowed, even when allowPrivateAddress is true[/-][+]Localhost is not allowed, even when `allowPrivateAddress` is `true`[/+]on Oct 19, 2026
Activity
dahlia commentedon Oct 17, 2026
Thanks for the report! This looks like a bug in
@fedify/testing. I reproduced it on2.0-maintenance, so the fix should target that branch.[-]Localhost is not allowed, even when allowPrivateAddress is true[/-][+]Localhost is not allowed, even when `allowPrivateAddress` is `true`[/+]Honor private addresses in testing federations