Documentation
¶
Overview ¶
Package safehttp provides HTTP clients for requests to URLs taken from project files. Hosted services must never be steered into internal networks through such URLs (server-side request forgery), and credentials attached to a request must never follow a redirect to another host.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func CheckSameOriginRedirect ¶
CheckSameOriginRedirect is an http.Client redirect policy that follows at most 5 redirects, all within the origin of the original request. Every client that carries credentials on each hop must use it, so a redirect to another host never receives them.
func IsPrivateHost ¶
IsPrivateHost returns true for hostnames that are obviously local, without resolving them. Names that resolve to private addresses are caught later by the transport's dialer.
func NewHTTPClient ¶
NewHTTPClient returns an HTTP client that follows redirects only within the same origin. Unless allowPrivate is set, it refuses private network addresses.
func NewTransport ¶
NewTransport returns an HTTP transport for talking to servers configured by project files. Unless allowPrivate is set, it refuses to dial addresses on loopback, private or link-local networks, which protects hosted services from being pointed at internal services through a connector URL.
Types ¶
This section is empty.
Source Files