fix: prevent .ipfs. duplication in subdomain gateway URLs #2449

SuchitraSwain · 2025-10-19T09:43:46Z

This PR fixes the issue where subdomain gateway URLs were incorrectly duplicating the .ipfs. subdomain when the gateway URL already contained an IPFS subdomain.

Problem

The original code in `checkSubdomainGateway` function was hardcoding `.ipfs.` in the subdomain URL construction:

```javascript
imgSubdomainUrl = new URL(`${gwUrl.protocol}//${IMG_HASH_1PX}.ipfs.${gwUrl.hostname}/?now=${Date.now()}&filename=1x1.png#x-ipfs-companion-no-redirect`)
```

This caused URLs like `https://ipfs.example.com\` to become `https://bafkreib6wedzfupqy7qh44sie42ub4mvfwnfukmw6s2564flajwnt4cvc4.ipfs.ipfs.example.com\`, which is incorrect and prevents users from using gateways that already have an IPFS subdomain.

Solution

The fix detects if the gateway URL already has an IPFS subdomain by checking if the hostname starts with `ipfs.` and handles both cases appropriately:

For gateways like `ipfs.example.com`: construct `hash.ipfs.example.com`
For gateways like `example.com`: construct `hash.ipfs.example.com`

Changes

Modified `checkSubdomainGateway` function in `src/bundles/gateway.js`
Added logic to detect existing IPFS subdomains
Updated URL construction to handle both scenarios correctly

Testing

Verified the fix works correctly for both scenarios:

✅ `https://example.com\` → `bafkreib6wedzfupqy7qh44sie42ub4mvfwnfukmw6s2564flajwnt4cvc4.ipfs.example.com`
✅ `https://ipfs.example.com\` → `bafkreib6wedzfupqy7qh44sie42ub4mvfwnfukmw6s2564flajwnt4cvc4.ipfs.example.com`
✅ `https://dweb.link\` → `bafkreib6wedzfupqy7qh44sie42ub4mvfwnfukmw6s2564flajwnt4cvc4.ipfs.dweb.link`

Related Issues

Fixes #2398

- Detect if gateway URL already has IPFS subdomain (starts with 'ipfs.') - Handle both cases: gateway with and without existing IPFS subdomain - Fixes issue where ipfs.example.com becomes ipfs.ipfs.example.com - Resolves ipfs#2398

SuchitraSwain · 2025-10-19T09:45:12Z

Please review @SgtPooki @acul71 @alikhere

Gunni · 2025-10-19T10:50:11Z

This is definitely an improvement but why is the ipfs subdomain mandatory?

SuchitraSwain · 2025-10-19T11:13:08Z

This is definitely an improvement but why is the ipfs subdomain mandatory?

So the "mandatory" nature isn't about forcing users to configure it, but rather about ensuring that when a subdomain gateway is configured, it works correctly and maintains the security benefits of content isolation

Gunni · 2025-10-19T11:15:48Z

There is no security difference between ipfs.example.com and stuff.example.com that are IPFS gateways.

- Add validateSubdomainGatewaySecurity function with security checks - Implement security scoring system (0-100) for gateway URLs - Add real-time security warnings in PublicSubdomainGatewayForm - Detect suspicious domains, HTTPS enforcement, and localhost warnings - Update checkSubdomainGateway to return security validation results - Add security best practices documentation to README - Maintain backward compatibility with existing functionality Addresses security concerns about subdomain gateway configurations and provides users with clear guidance on secure gateway selection.

SuchitraSwain · 2025-10-19T11:38:56Z

@Gunni Please review the security part

Gunni · 2025-10-19T12:17:50Z

The only one I see is if domain name includes an ipfs part of a domain but isn't the last part than its marked as a problem.

If a domain does not include ipfs at all then it's fine according to that code, right?

SuchitraSwain · 2025-10-19T12:20:45Z

The only one I see is if domain name includes an ipfs part of a domain but isn't the last part than its marked as a problem.

If a domain does not include ipfs at all then it's fine according to that code, right?

Yes, you are absolutely correct!
The validation logic only flags domains as problematic when they contain "ipfs." but it's not at the beginning of the hostname. Here's the breakdown:

What gets flagged as a problem:

example.ipfs.com ✅ This is fine - "ipfs." is at the beginning
my.ipfs.example.com ❌ This gets flagged - "ipfs." is in the middle
gateway.ipfs.service.com ❌ This gets flagged - "ipfs." is in the middle

What is completely fine:

example.com ✅ No "ipfs." at all - perfectly fine
gateway.example.com ✅ No "ipfs." at all - perfectly fine
mygateway.org ✅ No "ipfs." at all - perfectly fine

The Logic:
The condition hostname.includes('ipfs.') && !hostname.startsWith('ipfs.') means:

First part: hostname.includes('ipfs.') - Does the domain contain "ipfs." anywhere?
Second part: !hostname.startsWith('ipfs.') - But it's NOT at the very beginning?

If both conditions are true, then it's flagged as potentially confusing.

Why this makes sense:

ipfs.example.com is a standard pattern for IPFS subdomain gateways
example.ipfs.com could be confusing because it suggests the gateway is at example.ipfs.com but the actual IPFS content would be at hash.example.ipfs.com, which might not be the intended behavior

So your understanding is correct - domains without "ipfs." at all are completely fine according to this validation logic.

Gunni · 2025-10-19T19:08:35Z

What gets flagged as a problem:

1. example.ipfs.com ✅ This is fine - "ipfs." is at the beginning

2. my.ipfs.example.com ❌ This gets flagged - "ipfs." is in the middle

Wait, how do you do this check? I don't see you pulling from a Public Suffix List...

ipfs.co.uk would be blocked unless you use a Public Suffix List.

Gunni · 2025-10-19T19:17:52Z

src/bundles/gateway.js

+      // For gateways like ipfs.example.com, construct: hash.ipfs.example.com
+      imgSubdomainUrl = new URL(`${gwUrl.protocol}//${IMG_HASH_1PX}.${gwUrl.hostname}/?now=${Date.now()}&filename=1x1.png#x-ipfs-companion-no-redirect`)
+    } else {
+      // For gateways like example.com, construct: hash.ipfs.example.com
+      imgSubdomainUrl = new URL(`${gwUrl.protocol}//${IMG_HASH_1PX}.ipfs.${gwUrl.hostname}/?now=${Date.now()}&filename=1x1.png#x-ipfs-companion-no-redirect`)
+    }


Replace entire if with just:

imgSubdomainUrl = new URL(`${gwUrl.protocol}//${IMG_HASH_1PX}.${gwUrl.hostname}/?now=${Date.now()}&filename=1x1.png#x-ipfs-companion-no-redirect`)

The ipfs. subdomain part is entirely useless and annoying.

lidel · 2025-10-20T23:10:03Z

Hi, marking this as blocked for now. Before opening a PR there should be a clear description of real world bug with reproduction steps. So far there is none (example.com is not real gateway).

Let's continue in #2398 (comment) to confirm there is a problem in the first place.

SuchitraSwain · 2025-10-21T16:25:46Z

Hey @lidel @Gunni I didn't understand why it's blocked?

lidel

The original bug seems to be elsewhere, see #2398 (comment).

Because there is no real bug in webui, this PR seems to not fix anything, only tries to "fixup" if someone enters incorrect URL by "guessing" what is the right one.

However, instead of being a simple fix which retries on error when ipfs.ipfs. does not work, it brings unnecessary complexity, opinionated "scores" and "rules" what is secure and what is not – most of it makes no sense – see comments inline.

My understanding is that this PR, in current LLM-generated form, adds unnecessary complexity.
If you want to propose normalization of ipfs.example.com into example.com when cid.ipfs.ipfs.example.com fails, limit this PR to only that. It is not acceptable in current form.

ps. In the future please avoid implementing "fixes" for things that were not triaged (confirmed to be real bugs). The issue #2398 was not triaged.

lidel · 2025-10-21T21:17:02Z

src/bundles/gateway.js

+  // Bonus points for well-known domains
+  const wellKnownDomains = [
+    'dweb.link', 'ipfs.io', 'gateway.pinata.cloud',
+    'cloudflare-ipfs.com', 'ipfs.fleek.co'
+  ]


We should not hardcode domains, especially dead ones like cloudflare-ipfs.com

lidel · 2025-10-21T21:17:50Z

src/bundles/gateway.js

+    // Check for very short domains (potential typosquatting)
+    const domainParts = hostname.split('.')
+    if (domainParts.length >= 2) {
+      const tld = domainParts[domainParts.length - 1]
+      const domain = domainParts[domainParts.length - 2]
+      if (domain.length <= 2 && tld.length <= 2) {
+        warnings.push('Very short domain name may be a typo or malicious')
+      }
+    }


Unnecessary complexity

lidel · 2025-10-21T21:19:24Z

src/bundles/gateway.js

+    // Check for suspicious domains
+    const suspiciousPatterns = [
+      /\.tk$/, /\.ml$/, /\.ga$/, /\.cf$/, // Free domains often used for malicious purposes
+      /\.onion$/, // Tor hidden services
+      /localhost\./, /127\.0\.0\.1\./, /0\.0\.0\.0\./ // Localhost subdomains
+    ]
+
+    for (const pattern of suspiciousPatterns) {
+      if (pattern.test(hostname)) {
+        warnings.push('Gateway domain may be unreliable or potentially malicious')
+        break
+      }
+    }


This is not a place to make judgement about domain being safe or not.
ipfs.io itself is not considered "safe" by most of software.

We should only test if domain is a valid subdomain gateway and if it correctly implements URL convention and CORS headers.

Please remove this.

lidel · 2025-10-21T21:20:11Z

src/bundles/gateway.js

+    // Check for localhost/private IPs in production
+    const hostname = url.hostname.toLowerCase()
+    const isLocalhost = hostname === 'localhost' ||
+                       hostname === '127.0.0.1' ||
+                       hostname.startsWith('192.168.') ||
+                       hostname.startsWith('10.') ||
+                       hostname.startsWith('172.')
+
+    if (isLocalhost) {
+      warnings.push('Using localhost/private IP gateway may not be accessible to other users')
+    }


We should not block users from being able to use LAN / private network gateways without DNS.

Please remove this

SuchitraSwain requested a review from a team as a code owner October 19, 2025 09:43

Merge branch 'main' into fix/subdomain-gateway-ipfs-duplication

8ab8a78

SuchitraSwain temporarily deployed to Deploy October 19, 2025 09:46 — with GitHub Actions Inactive

SuchitraSwain temporarily deployed to Deploy October 19, 2025 11:40 — with GitHub Actions Inactive

e2e test fixed

327367b

SuchitraSwain temporarily deployed to Deploy October 19, 2025 12:04 — with GitHub Actions Inactive

Gunni reviewed Oct 19, 2025

View reviewed changes

lidel added the status/blocked Unable to be worked further until needs are met label Oct 20, 2025

Merge branch 'main' into fix/subdomain-gateway-ipfs-duplication

973c80b

SuchitraSwain temporarily deployed to Deploy October 21, 2025 12:58 — with GitHub Actions Inactive

lidel mentioned this pull request Oct 21, 2025

Cannot use subdomain gateway with ipfs subdomain #2398

Open

lidel requested changes Oct 21, 2025

View reviewed changes

fix: prevent .ipfs. duplication in subdomain gateway URLs #2449

Are you sure you want to change the base?

fix: prevent .ipfs. duplication in subdomain gateway URLs #2449

Uh oh!

Conversation

SuchitraSwain commented Oct 19, 2025

Problem

Solution

Changes

Testing

Related Issues

Uh oh!

SuchitraSwain commented Oct 19, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Gunni commented Oct 19, 2025

Uh oh!

SuchitraSwain commented Oct 19, 2025

Uh oh!

Gunni commented Oct 19, 2025

Uh oh!

SuchitraSwain commented Oct 19, 2025

Uh oh!

Gunni commented Oct 19, 2025

Uh oh!

SuchitraSwain commented Oct 19, 2025

Uh oh!

Gunni commented Oct 19, 2025

Uh oh!

Gunni Oct 19, 2025

Choose a reason for hiding this comment

Uh oh!

lidel commented Oct 20, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

SuchitraSwain commented Oct 21, 2025

Uh oh!

lidel left a comment

Choose a reason for hiding this comment

Uh oh!

lidel Oct 21, 2025

Choose a reason for hiding this comment

Uh oh!

lidel Oct 21, 2025

Choose a reason for hiding this comment

Uh oh!

lidel Oct 21, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

lidel Oct 21, 2025

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

SuchitraSwain commented Oct 19, 2025 •

edited

Loading

lidel commented Oct 20, 2025 •

edited

Loading

lidel Oct 21, 2025 •

edited

Loading