A push subscription URL was refused only when its host was a local or
reserved IP literal. A host name that resolved to 127.0.0.1, a private
range or 169.254.169.254 passed, so any signed-in user could make the
server send the verification request, and every later push, to a
service inside its own network.
Push requests now connect only to public addresses. Host names are
checked when they resolve, which also covers redirects and a name that
changes its answer after the subscription is created, and push never
goes through a configured proxy. The shared check is for every request
whose destination outsiders choose.
Test: a subscription to https://localhost:<port>/push got its
verification request on the local listener on main; now nothing
connects.
jcoffey-dev
a5d1bfcd4b