Each endpoint below answers with an HTTP redirect. The redirect target is printed in the table, so you can see what is being offered without following it. Most of the targets are an address on the client's own machine, written several different ways.
This host is a test fixture for measuring whether an HTTP client refuses to follow a redirect that leaves the public internet and points back at the client's own loopback or private network. It serves nothing else.
| endpoint | status | Location | what it tests |
|---|---|---|---|
/r/loopback-ip | 302 | http://127.0.0.1:8311/internal/admin/config | the canonical form; any guard at all should catch this |
/r/loopback-ip-307 | 307 | http://127.0.0.1:8311/internal/admin/config | same target, method-preserving status |
/r/loopback-name | 302 | http://localhost:8311/internal/admin/config | resolves to loopback via DNS rather than being literal |
/r/loopback-short | 302 | http://127.1:8311/internal/admin/config | 127.1 is a legal spelling of 127.0.0.1 |
/r/loopback-decimal | 302 | http://2130706433:8311/internal/admin/config | the same address as a 32-bit integer |
/r/loopback-octal | 302 | http://0177.0.0.1:8311/internal/admin/config | octal first octet |
/r/loopback-ipv6 | 302 | http://[::1]:8311/internal/admin/config | IPv6 loopback |
/r/loopback-mapped | 302 | http://[::ffff:127.0.0.1]:8311/internal/admin/config | IPv4-mapped IPv6 loopback |
/r/private-192 | 302 | http://192.168.0.1/ | RFC1918, not loopback |
/r/private-10 | 302 | http://10.0.0.1/ | RFC1918, not loopback |
/r/private-172 | 302 | http://172.16.0.1/ | RFC1918, not loopback |
/r/same-origin | 302 | /landed | CONTROL: must be followed |
/r/public | 302 | http://example.com/ | CONTROL: must be followed |
/r/chain/<n> — n redirects within this host,
then one to 127.0.0.1:8311. Tests whether a client that
checks the first target also checks later ones. Max n =
10.
/form — an HTML form whose POST target answers 307 to
loopback, preserving method and body. Tests the same question for a request
that carries data rather than a bare GET.
/log — this host's request log, newest last.
The cloud-metadata variant is disabled on this deployment.
Target port 8311 is where the fixture expects a listener on the client side; without one, a followed redirect fails to connect, which looks different in the log from a refusal to follow.