README
¶
SafeHTTP Client
SafeHTTP provides users with a standard http client with sensible defaults that can be used to make http requests to untrusted URLs. This is useful, for instance, for dispatching outbound webhook requests with URLs that are provided by customers. SafeHTTP Client inspects the final ip address, instead of simply the provided URL, protecting you against the threat of SSRF even if the attacker uses a DNS record that looks harmless, but that points to localhost or other forbidden addresses.
Much of the code was adapted from Andrew Ayer's public domain code.
Installing
go get github.com/AlchemyTelcoSolutions/safehttp
Usage
// create client
client := safehttp.NewClient(c.opts)
// set forbidden endpoint
req, err := http.NewRequest("POST", "http://localhost:5000", nil)
if err != nil {
// crash and burn
}
// do actual request, should get a safehttp error
res, err := client.Do(req)
if err != nil {
// safehttp won't let the call to actually happen
}
Documentation
¶
Index ¶
Constants ¶
This section is empty.
Variables ¶
var ( BadNetworkTypeErrCode uint = 1 BadHostPortPairErrCode uint = 2 BadIPAddressErrCode uint = 3 NotPublicIPAddressErrCode uint = 4 )
Functions ¶
func NewClient ¶
NewClient returns a pointer to an http.Client with some sensible defaults, plus a custon dialer control that checks the receiving IP address against a forbidden-list, and checks the network type against an allow-list. Both lists have sensible defaults that can be added to by means of the Options struct
Types ¶
type Options ¶
Options is a struct that can be passed into NewClient to override the default allow-list of network types and the default forbidden-list of ip addresses
type SafeHTTPError ¶
type SafeHTTPError struct {
Err error
Text string
ErrCode uint
// contains filtered or unexported fields
}
SafeHTTPError is the error type returned by the SafeHTTPClient when an attempt is made to use a forbidden network type or IP address
func (*SafeHTTPError) Error ¶
func (err *SafeHTTPError) Error() string
func (*SafeHTTPError) Unwrap ¶
func (err *SafeHTTPError) Unwrap() error
Source Files