{"record":{"id":"834f85d307e0be83","repo":"spring-projects/spring-security","slug":"hostname-s-resolved-to-s-will-be-used-on-ip-ad","errorCode":null,"errorMessage":"Hostname '%s' resolved to %s will be used on IP address matching","messagePattern":"Hostname '(.+?)' resolved to (.+?) will be used on IP address matching","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"core/src/main/java/org/springframework/security/util/matcher/IpInetAddressMatcher.java","lineNumber":77,"sourceCode":"\t\t\tString[] parts = Objects.requireNonNull(StringUtils.split(ipAddress, \"/\"));\n\t\t\trequiredAddress = parts[0];\n\t\t\tnMaskBits = Integer.parseInt(parts[1]);\n\t\t}\n\t\telse {\n\t\t\trequiredAddress = ipAddress;\n\t\t\tnMaskBits = -1;\n\t\t}\n\t\tthis.requiredAddress = InetAddressParser.parseAddress(requiredAddress);\n\t\tthis.nMaskBits = nMaskBits;\n\t\tAssert.isTrue(this.requiredAddress.getAddress().length * 8 >= this.nMaskBits, () -> String\n\t\t\t.format(\"IP address %s is too short for bitmask of length %d\", requiredAddress, this.nMaskBits));\n\t}\n\n\tprivate static InetAddress parse(String address) {\n\t\ttry {\n\t\t\tInetAddress result = InetAddress.getByName(address);\n\t\t\tif (address.matches(\".*[a-zA-Z\\\\-].*$\") && !address.contains(\":\")) {\n\t\t\t\tlogger.warn(\"Hostname '\" + address + \"' resolved to \" + result.toString()\n\t\t\t\t\t\t+ \" will be used on IP address matching\");\n\t\t\t}\n\t\t\treturn result;\n\t\t}\n\t\tcatch (UnknownHostException ex) {\n\t\t\tthrow new IllegalArgumentException(String.format(\"Failed to parse address '%s'\", address), ex);\n\t\t}\n\t}\n\n\t@Override\n\tpublic boolean matches(@Nullable InetAddress toCheck) {\n\t\tif (toCheck == null) {\n\t\t\treturn false;\n\t\t}\n\t\tif (this.nMaskBits < 0) {\n\t\t\treturn toCheck.equals(this.requiredAddress);\n\t\t}\n\t\tbyte[] remAddr = toCheck.getAddress();","sourceCodeStart":59,"sourceCodeEnd":95,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/core/src/main/java/org/springframework/security/util/matcher/IpInetAddressMatcher.java#L59-L95","documentation":"IpInetAddressMatcher.matches CIDR/IP address patterns. In parse(), if the configured address contains letters (i.e. it is a hostname, not an IP), it is resolved via InetAddress.getByName and a warning is logged because hostname resolution happens once at matcher construction; DNS changes afterwards are ignored, which can surprise developers.","triggerScenarios":"An IP matcher is created (e.g. requestMatchers for hasIpAddress, or IP authorization rules) with a hostname like 'example.com' instead of an IP/CIDR, and it resolves successfully at construction time.","commonSituations":"Writing hasIpAddress('myhost.example.org') instead of an IP or CIDR; config with DNS names in allow/deny lists; environments where the resolved IP changes (dynamic DNS, load balancers).","solutions":["Replace the hostname with a literal IP address or CIDR range (e.g. 203.0.113.0/24)","If DNS must be used, accept that resolution is fixed at startup and restart on DNS changes","Implement a custom WebMatcher/authorization rule that re-resolves the hostname per request"],"exampleFix":"// before\n.access(\"hasIpAddress('myapp.example.com')\")\n// after\n.access(\"hasIpAddress('203.0.113.10')\") // or CIDR: '203.0.113.0/24'","handlingStrategy":"validation","validationCode":"// Validate IP matcher inputs before configuring\nString v = \"myapp.example.com\";\nif (v.matches(\".*[a-zA-Z\\\\-].*\") && !v.contains(\":\")) {\n  throw new IllegalArgumentException(\"Use an IP/CIDR, not a hostname: \" + v);\n}","typeGuard":"boolean isIpOrCidr(String s) {\n  return !s.matches(\".*[a-zA-Z\\\\-].*\") || s.contains(\":\"); // reject hostnames, allow IPv6\n}","tryCatchPattern":null,"preventionTips":["Use literal IPs or CIDR ranges in hasIpAddress and IP matchers","Remember hostname resolution is one-time at startup; document DNS freeze semantics","Wrap dynamic-DNS clients with a custom matcher that re-resolves per request"],"tags":["spring-security","ip-matching","dns","configuration"],"backgroundTag":"invalid-config-value","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}