DEV Community

Schiff Heimlich
Schiff Heimlich

Posted on

IPv6 zone identifiers in URLs are a quiet parser gotcha

#backend #networking #programming #python

You're debugging a URL parsing issue in your load balancer logs. Someone pasted a link like http://[fe80::1%eth0]:8080/ and your proxy choked on it.

That's the zone identifier — the %eth0 part. IPv6 link-local addresses need it to specify which interface to use. The problem is, zone identifiers don't actually belong in URLs, and different tools handle them very differently.

What zone identifiers are for

Link-local IPv6 addresses like fe80::1 are only usable on a single network segment. When you have multiple interfaces, the OS needs to know which one to send the packet out of. So you append %eth0 (or %1, %en0, whatever the interface name is) to disambiguate.

In code, this looks like:

import socket

# This is valid - bind to a specific interface
sock = socket.socket(socket.AF_INET6)
sock.bind(('fe80::1%eth0', 8080, 0, 0))
Enter fullscreen mode Exit fullscreen mode

Why URLs are different

RFC 3986 is explicit: the zone identifier is not part of the URL syntax. It's a parsing artifact that only makes sense in address literals used by the local system.

Browsers know this. Chrome and Firefox strip zone identifiers before sending the URL to a server. But if you're writing a proxy, a URL parser, a DNS tool, or anything that processes URLs programmatically, you might be getting raw user input with zone identifiers still attached.

Where it breaks

  • URL parsers: stdlib urllib.parse in Python will happily parse [fe80::1%eth0] as the host, but whether it keeps or strips the zone depends on the library and version
  • Load balancers: HAProxy, nginx, Envoy all handle this differently in their URL parsing layers
  • DNS tools: Some dig or nslookup wrappers that accept URLs will fail or misinterpret the zone
  • Log parsers: If you're ingesting access logs and someone hotlinks a zone-scoped IPv6 address, your parser might silently drop the zone or fail to match the address

What to do about it

  1. Normalize on input: Strip zone identifiers from IPv6 addresses in URLs before processing, unless your code is actually doing local interface binding
  2. Be consistent: If you're storing or comparing addresses, normalize them the same way every time
  3. Check your tools: Review how your proxy, load balancer, or any URL-processing code handles link-local IPv6 addresses

The short version

Zone identifiers are for local interface routing, not for URLs. Browsers strip them. Your parsers might not. If you're building anything that touches IPv6 URLs, this is one of those details that will bite you once before you remember to handle it.

Not groundbreaking, but if you've ever spent an hour wondering why a link-local address won't bind or why a URL won't parse, this is probably why.

Top comments (0)