IP addresses hardcoded in source code couple the application to a specific infrastructure configuration. Today’s services have an ever-changing architecture due to their scaling and redundancy needs. When an IP address changes, every hardcoded occurrence must be found and updated, which has an impact on development, delivery, and deployment:
- Developers must fix the code every time the address changes, instead of having an operations team update a configuration file.
- It leads to using the same address in every environment (dev, staging, QA, production).
Why is this an issue?
Hardcoding an IP address embeds infrastructure configuration directly into the application. This means any change to the network environment—such as moving a service to a different host or scaling horizontally—requires a code modification and a full redeployment. Unlike a domain name, a hardcoded address also makes it harder to use different values across environments such as development, staging, and production.
What is the potential impact?
Environment coupling
A hardcoded IP address is the same in every environment the application runs in. This makes it difficult to point development, staging, and production builds at different infrastructure without modifying the source code.
Increased deployment friction
Any change to the target host—such as migrating a service, scaling out, or rotating infrastructure—requires a code change and a full redeployment cycle. This prevents operational teams from making infrastructure adjustments independently and slows down incident response.
Exceptions
No issue is reported for the following well-known, special-purpose addresses, as they do not represent configurable infrastructure endpoints:
- Loopback addresses 127.0.0.0/8 in CIDR notation (from 127.0.0.0 to 127.255.255.255)
- Broadcast address 255.255.255.255
- Non-routable address 0.0.0.0
- Strings of the form
2.5.<number>.<number>as they often match Object Identifiers (OID) - Addresses in the ranges 192.0.2.0/24, 198.51.100.0/24, 203.0.113.0/24, reserved for documentation purposes by RFC 5737
- Addresses in the range 2001:db8::/32, reserved for documentation purposes by RFC 3849
How to fix it
Code examples
The following code contains a hardcoded IP address instead of reading it from configuration or environment variables.
Noncompliant code example
var ip = "192.168.12.42"; // Noncompliant
var address = IPAddress.Parse(ip);
Compliant solution
var ip = ConfigurationManager.AppSettings["myapplication.ip"];
var address = IPAddress.Parse(ip);