Skip to content

Latest commit

 

History

History
40 lines (29 loc) · 775 Bytes

README.md

File metadata and controls

40 lines (29 loc) · 775 Bytes

antissrf

This package provides an anti SSRF(Server Side Request Forgery) http client.

This client will return an error if the remote address is:

  • loopback address
  • multicast address
  • link local address
  • private address
  • unique local address
  • additionally blacklisted by user

Usage

antissrf.Client() just returns *http.Client

var client = antissrf.Client()

func main() {
    // OK
    res, err := client.Get("http://example.com")

    // NG
    res, err := client.Get("http://169.254.169.254/")
}

If you want to blacklist additional address spaces:

var client = antissrf.Client(
	antissrf.MustParseCIDR("192.0.2.0/24"),
	antissrf.MustParseCIDR("198.51.100.0/24"),
	antissrf.MustParseCIDR("203.0.113.0/24"))

License

MIT