v154 · targetAddressSpace
What counts as local
Three address spaces, three sets of rules, and a surprising amount of ambiguity at the edges. Classify a list of hosts and see which connections need the option — and which ones people think are local but are not.
Classify some hosts
| host | space | why | needs targetAddressSpace? |
|---|
The classification here is by address literal, which is what the browser can do before a DNS lookup. A name like printer.local cannot be classified until it resolves — which is exactly why the page has to declare its intent rather than the browser inferring it. That declaration is what the option is.
the three spaces
- loopback —
127.0.0.0/8and::1. The same machine. Treated as the most trusted, because nothing on the network can reach it. - local — private ranges:
10/8,172.16/12,192.168/16, link-local169.254/16, and IPv6 unique-localfc00::/7. Your network; other people's devices. - public — everything else. No declaration needed, because there is no privilege to escalate.