httputil

func NoRedirectClient ¶

func NoRedirectClient(timeout time.Duration) *http.Client

NoRedirectClient returns an *http.Client that:

• never follows redirects (prevents token/credential leakage to redirect targets)
• enforces SSRF protection at DIAL time: every TCP connection's resolved IP is re-checked against the private/internal blocklist, closing the DNS-rebinding / TOCTOU window between URL validation and the actual request
• has the supplied timeout (default 15s)

Use for outbound requests where the destination is partially or fully operator/user-controlled (callbacks, SIEM exports, secrets backends).

func ValidatePublicURL ¶

func ValidatePublicURL(rawURL string, requireHTTPS bool) error

ValidatePublicURL checks that rawURL:

1. Parses successfully
2. Uses http or https scheme
3. Has a non-empty host
4. Does not resolve to a loopback, link-local (169.254.x.x / fe80::/10), or private (RFC 1918 / RFC 4193) address — blocks SSRF to IMDS, Redis, Vault, etc.

Pass requireHTTPS=true to additionally reject plain http:// URLs.