Documentation
¶
Overview ¶
Package safehttp can be used for making http requests when the hostname is not trusted (user inputs). It will avoid SSRF by ensuring that the IP address which will connect is not a private address, or loopback. It also checks that the port is 80 or 443, not anything else.
Operators can configure trusted private networks (CIDRs) to allow safehttp callers to reach private addresses in closed-network deployments.
Index ¶
Constants ¶
This section is empty.
Variables ¶
var ClientWithKeepAlive = &http.Client{
Transport: transportWithKeepAlive,
}
ClientWithKeepAlive is an http client that can be used to avoid SSRF. And it has keep-alive (contrary to safehttp.DefaultClient). The typical use case is moving a Cozy.
var DefaultClient = &http.Client{ Timeout: 10 * time.Second, Transport: safeTransport, }
DefaultClient is an http client that can be used instead of http.DefaultClient to avoid SSRF. It has the same default configuration, except it disabled keep-alive, as it is probably not useful in such cases.
Functions ¶
func SetTrustedPrivateNetworks ¶
SetTrustedPrivateNetworks parses the given CIDR strings and stores them for use by safeControl. It should be called once at startup. If any CIDR is invalid, it returns an error and does not update the allowlist.
Types ¶
This section is empty.
Source Files