Admin endpoints rejecting `localhost:2019` as Host

[louwers]

Issue Details

According to the documentation:

if the listen address is loopback (e.g. localhost or a loopback IP, or a unix socket) then the allowed origins are localhost, ::1 and 127.0.0.1, joined with the listen address port (so localhost:2019 is a valid origin).

However localhost:2019 is actually rejected with the message

{"error":"host not allowed: localhost:2019"}

So for example this doesn't work:

 curl -v http://localhost:2019/metrics

While this works:

curl -v http://localhost:2019/metrics -H "Host: localhost"

Caddy 2.11.2

{
        metrics {
                per_host
        }

        admin {
                origins localhost
        }
}

Assistance Disclosure

AI not used

If AI was used, describe the extent to which it was used.

No response

[steadytao]

This looks valid to me. With origins localhost, the current code keeps that value literal and checkHost() compares it literally to r.Host so localhost does not match localhost:2019.

So this is at least a docs/UX bug and possibly an implementation bug. The docs explicitly say localhost:2019 is valid for loopback admin and the docs example also uses origins localhost under admin :2019, which is currently misleading.

@louwers As a temporary workaround, origins localhost:2019 should work.

[louwers]

@steadytao I tried that, but Caddy rejects that config...

I am using admin :2019 now, which works...

[mholt]

I've confirmed there's an inconsistency between the cited docs and the actual behavior. Indeed, origins localhost:2019 works -- but you say "Caddy rejects that config". It works for me. Can you post more info, @louwers ? And then we'll decide which way we need to fix this.

[louwers]

OK, what happened what that there was an issue reloading the config.

You're right, it works.

[mholt]

Sounds good; we should either adjust the docs or the code then to be in mutual agreement. I will need some time to review which one is more intentional/correct.