Bypass proxy on loopback IPs

packages/http-client/__tests__/proxy.test.ts

@@ -223,18 +223,28 @@ describe('proxy', () => {
     expect(_proxyConnects).toEqual(['httpbin.org:443'])
   })
 
-  it('HttpClient does basic https get request when bypass proxy', async () => {
+it('HttpClient bypasses proxy for loopback addresses (localhost, ::1, 127.*)', async () => {
-    process.env['https_proxy'] = _proxyUrl
+  // setup a server listening on localhost:8091
-    process.env['no_proxy'] = 'httpbin.org'
+  var server = http.createServer(function (request, response) {
+    response.writeHead(200);
+    request.pipe(response);
+  });
+  await server.listen(8091)
+  try {
+    process.env['http_proxy'] = _proxyUrl 
     const httpClient = new httpm.HttpClient()
     const res: httpm.HttpClientResponse = await httpClient.get(
-      'https://httpbin.org/get'
+      'http://localhost:8091'
     )
     expect(res.message.statusCode).toBe(200)
     const body: string = await res.readBody()
-    const obj = JSON.parse(body)
+    expect(body).toEqual('');
-    expect(obj.url).toBe('https://httpbin.org/get')
+    // proxy at _proxyUrl was ignored
-    expect(_proxyConnects).toHaveLength(0)
+    expect(_proxyConnects).toEqual(undefined)
+  }
+  finally {
+    await server.close()
+  }
 })
 
   it('proxyAuth not set in tunnel agent when authentication is not provided', async () => {

packages/http-client/src/proxy.ts

@@ -25,6 +25,11 @@ export function checkBypass(reqUrl: URL): boolean {
     return false
   }
 
+  const reqHost = reqUrl.hostname
+  if (isLoopbackAddress(reqHost)) {
+    return true
+  }
+
   const noProxy = process.env['no_proxy'] || process.env['NO_PROXY'] || ''
   if (!noProxy) {
     return false
@@ -66,3 +71,8 @@ export function checkBypass(reqUrl: URL): boolean {
 
   return false
 }
+
+function isLoopbackAddress(host: string): boolean {
+  const hostUpper = host.toUpperCase()
+  return hostUpper === 'LOCALHOST' || hostUpper.startsWith('127.') || hostUpper.startsWith('::1')
+}