fix: allow header-based routing when Host is an IP address#2581
fix: allow header-based routing when Host is an IP address#2581tomassrnka merged 1 commit intomainfrom
Conversation
#2540 introduced shouldParseHeaders() to guard against header spoofing on per-sandbox hostnames (e.g. 49983-sbx.e2b.app), where the sandbox ID is encoded in the hostname and headers should not override it. However, isLocalRequestHost() only accepted localhost and loopback IPs, which means any IP-based access (bridge networks, LAN, on-prem) was rejected — the proxy ignored routing headers and fell through to parseHost(), which cannot extract a sandbox ID from an IP address. An IP address can never contain sandbox routing info in its hostname, so there is nothing for headers to conflict with. parseHost() will always fail on an IP host regardless. Headers are the only routing mechanism that can work. Widen the check from ip.IsLoopback() to ip != nil so header-based routing works for all IP hosts. The per-sandbox hostname guard is unaffected — headers are still ignored for hosts like 49983-sbx.e2b.app where the hostname is authoritative. Discovered via e2b-local nightly build failure: the SDK connects to the client-proxy via a bridge network IP (192.168.100.66:3002) and was getting HTTP 400 "invalid host" on every sandbox command. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
ⓘ You've reached your Qodo monthly free-tier limit. Reviews pause until next month — upgrade your plan to continue now, or link your paid account if you already have one. |
PR SummaryMedium Risk Overview Reviewed by Cursor Bugbot for commit a4e825d. Bugbot is set up for automated code reviews on this repo. Configure here. |
There was a problem hiding this comment.
An organization admin can view or raise the cap at claude.ai/admin-settings/claude-code. The cap resets at the start of the next billing period.
Once the cap resets or is raised, push a new commit or reopen this pull request to trigger a review.
❌ 10 Tests Failed:
View the top 2 failed test(s) by shortest run time
View the full list of 10 ❄️ flaky test(s)
To view more test analytics, go to the Test Analytics Dashboard |
There was a problem hiding this comment.
Code Review
This pull request updates the isLocalRequestHost function to treat all valid IP addresses as local, enabling header-based routing for IP-based hosts. Corresponding test cases for private and public IPv4 addresses have been added to verify this behavior. I have no feedback to provide.
Summary
Fixes a regression from #2540 that broke SDK connectivity for any IP-based access to the client-proxy (bridge networks, LAN, on-prem deployments, e2b-local).
isLocalRequestHost()only acceptedlocalhostand loopback IPs (127.0.0.1,::1)192.168.100.66:3002, routing headers (E2b-Sandbox-Id,E2b-Sandbox-Port) were silently ignoredparseHost()then tried to extract a sandbox ID from the IP address and failed withErrInvalidHost→ HTTP 400The fix: widen
isLocalRequestHost()fromip.IsLoopback()toip != nil.This is safe because the
shouldParseHeadersguard exists to prevent header spoofing on per-sandbox hostnames like49983-sbx.e2b.app, where the hostname is authoritative. An IP address can never contain sandbox routing info —parseHost()will always fail on it — so there is nothing for headers to conflict with. Headers are the only routing mechanism that can work for IP hosts.The per-sandbox hostname guard is unaffected: headers are still ignored when
r.Hostis a domain like49983-sbx.e2b.app.How it was found
e2b-local nightly build on
2026-05-05failed the sandbox smoke test. The build itself succeeded, butsandbox.commands.run()returnedHTTP 400because the client-proxy rejected the bridge network host192.168.100.66:3002:The previous night's build (using commit
92ea305dd, before #2540) passed. Today's build (usingae68b805a, after #2540) failed.Test plan
TestGetTargetFromRequesttests pass🤖 Generated with Claude Code