diff -u b/core/tests/Drupal/Tests/Core/DrupalKernel/ValidateHostnameTest.php b/core/tests/Drupal/Tests/Core/DrupalKernel/ValidateHostnameTest.php
--- b/core/tests/Drupal/Tests/Core/DrupalKernel/ValidateHostnameTest.php
+++ b/core/tests/Drupal/Tests/Core/DrupalKernel/ValidateHostnameTest.php
@@ -21,33 +21,37 @@
    * Tests hostname validation.
    *
    * @covers ::validateHostname()
+   *
+   * @dataProvider providerTestValidateHostname
    */
-  public function testValidateHostame() {
-    // Verifies that DrupalKernel::validateHostname() prevents invalid
-    // characters.
-    $this->assertFalse($this->validHttpHost('security/.drupal.org:80'), 'HTTP_HOST with / is invalid');
-    $this->assertFalse($this->validHttpHost('security\\.drupal.org:80'), 'HTTP_HOST with \\ is invalid');
-    $this->assertFalse($this->validHttpHost('security<.drupal.org:80'), 'HTTP_HOST with &lt; is invalid');
-    $this->assertFalse($this->validHttpHost('security..drupal.org:80'), 'HTTP_HOST with .. is invalid');
-    // Verifies that host names are shorter than 1000 characters.
-    $this->assertFalse($this->validHttpHost(str_repeat('x', 1001)), 'HTTP_HOST with more than 1000 characters is invalid.');
-    $this->assertFalse($this->validHttpHost(str_repeat('.', 101)), 'HTTP_HOST with more than 100 subdomains is invalid.');
-    $this->assertFalse($this->validHttpHost(str_repeat(':', 101)), 'HTTP_HOST with more than 100 portseparators is invalid.');
+  public function testValidateHostname($hostname, $message, $expected = FALSE) {
+    $server = ['HTTP_HOST' => $hostname];
+    $request = new Request([], [], [], [], [], $server);
+    $validated_hostname = DrupalKernel::validateHostname($request);
+    $this->assertSame($expected, $validated_hostname, $message);
   }
 
   /**
-   * Validates a spoofed HTTP_HOST.
-   *
-   * @param $hostname
-   *   The hostname to use for the HTTP_HOST.
-   *
-   * @return bool
-   *   TRUE if the spoofed hostname is valid, FALSE otherwise.
+   * Provides test data for testValidateHostname().
    */
-  protected function validHttpHost($hostname) {
-    $server = array('HTTP_HOST' => $hostname);
-    $request = new Request(array(), array(), array(), array(), array(), $server);
-    return DrupalKernel::validateHostname($request);
+  public function providerTestValidateHostname() {
+    $data = [];
+    // Verifies that DrupalKernel::validateHostname() prevents invalid
+    // characters.
+    $data[] = ['security/.drupal.org:80', 'HTTP_HOST with / is invalid'];
+    $data[] = ['security/.drupal.org:80', 'HTTP_HOST with / is invalid'];
+    $data[] = ['security\\.drupal.org:80', 'HTTP_HOST with \\ is invalid'];
+    $data[] = ['security<.drupal.org:80', 'HTTP_HOST with &lt; is invalid'];
+    $data[] = ['security..drupal.org:80', 'HTTP_HOST with .. is invalid'];
+    // Verifies that host names are shorter than 1000 characters.
+    $data[] = [str_repeat('x', 1001), 'HTTP_HOST with more than 1000 characters is invalid.'];
+    $data[] = [str_repeat('.', 101), 'HTTP_HOST with more than 100 subdomains is invalid.'];
+    $data[] = [str_repeat(':', 101), 'HTTP_HOST with more than 100 portseparators is invalid.'];
+    // Verifies that a valid hostname is allowed.
+    $data[] = ['security.drupal.org:80', 'Properly formed HTTP_HOST is valid.', TRUE];
+    // IPv6 loopback address
+    $data[] = ['[::1]:80', 'HTTP_HOST containing IPv6 loopback is valid.', TRUE];
+    return $data;
   }
 
 }