Documentation
¶
Overview ¶
Package netguard is the single outbound-network policy for AuthKit: the private/reserved address list, the resolve-then-dial SSRF guard, and the timeout-bounded HTTP client every package uses for fetches it does not fully control (JWKS, application documents, IdP endpoints).
Index ¶
Constants ¶
const DefaultTimeout = 30 * time.Second
DefaultTimeout bounds AuthKit's outbound HTTP calls. A slow or hostile endpoint must never wedge a request goroutine, and single-flighted fetches (JWKS) would otherwise stall every concurrent waiter.
Variables ¶
This section is empty.
Functions ¶
func Client ¶
Client returns a timeout-bounded *http.Client over Transport(allowPrivate). timeout <= 0 uses DefaultTimeout.
func IsInternalHostname ¶
IsInternalHostname reports whether host names a well-known internal target (localhost, cloud metadata aliases, Docker/Podman host-access names). It is a syntactic check for registration-time validation; the dialer's post-resolution IP check is the layer that catches everything else.
func IsPrivateIP ¶
IsPrivateIP reports whether ip is loopback, link-local, multicast, unspecified, or inside PrivateBlocks.
func Transport ¶
Transport returns an http.Transport wired to DialerWith(net.DefaultResolver, allowPrivate) with bounded handshake and header timeouts. A guarded transport never uses an egress proxy: the proxy would be dialed in place of the resolved target and the private-address check would no longer see the real destination.
Types ¶
type DialFunc ¶
DialFunc is the http.Transport.DialContext shape.
func DialerWith ¶
DialerWith is Dialer with an explicit Resolver.
Source Files