Drop-in SSRF protection for httpx

Navigation

Verified details

These details have been verified by PyPI
Project links
GitHub Statistics
Maintainers
Avatar for Zaczero from gravatar.com Zaczero

Unverified details

These details have not been verified by PyPI
Meta
  • License Expression: 0BSD
    SPDX License Expression
  • Author: Kamil Monicz
  • Tags anyio , async , asyncio , client , dns , dns-cache , http , httpx , security , ssrf , ssrf-protection , trio , web-security
  • Requires: Python >=3.9
Classifiers
Report project as malware

Project description

httpx-secure

PyPI - Python Version Liberapay Patrons GitHub Sponsors

Drop-in SSRF protection for httpx.

Why Use This?

  • SSRF Protection: Block requests to private/internal IP addresses
  • Custom Validation: Extend with your own validation logic
  • Minimal Overhead: Efficient implementation with built-in DNS caching
  • Broad Python Support: Compatible with Python 3.9+
  • Semantic Versioning: Predictable, reliable updates
  • Zero-Clause BSD: Public domain, use freely anywhere

Installation

pip install httpx-secure

Quick Start

import httpx
from httpx_secure import httpx_ssrf_protection

client = httpx_ssrf_protection(
    httpx.AsyncClient(),
    dns_cache_size=1000,  # Cache up to 1000 DNS resolutions
    dns_cache_ttl=600,    # Cache for 10 minutes
)

await client.get("https://public.domain")   # Allowed
await client.get("https://private.domain")  # Blocked

Custom Validation

For example, implement a simple domain whitelist to restrict requests to specific hosts:

import httpx
from httpx_secure import httpx_ssrf_protection
from ipaddress import IPv4Address, IPv6Address

def custom_validator(
    hostname: str,
    ip: IPv4Address | IPv6Address,
    port: int
) -> bool:
    return hostname in {
        "whitelisted.domain",
        "webhook.partner.com",
    }

client = httpx_ssrf_protection(
    httpx.AsyncClient(),
    custom_validator=custom_validator,
)

await client.get("https://whitelisted.domain")  # Allowed
await client.get("https://unknown.domain")      # Blocked

How It Works

  1. Cache Lookup: First checks if the host has been recently validated and cached
  2. DNS Resolution: If not cached, resolves the hostname to an IP address
  3. Validation: Verifies the IP is globally routable, blocking private/internal addresses
  4. Custom Validation: If provided, your custom validator is called for additional checks
  5. Request Modification: Rewrites the request to use the validated IP directly

The DNS cache significantly reduces latency for repeated requests, while per-host locking ensures efficient concurrent resolution of parallel requests.

[!TIP] The SSRF protection applies to all HTTP methods (GET, POST, PUT, DELETE, etc.) and automatically validates redirects to prevent SSRF attacks through redirect chains.

Project details

Verified details

These details have been verified by PyPI
Project links
GitHub Statistics
Maintainers
Avatar for Zaczero from gravatar.com Zaczero

Unverified details

These details have not been verified by PyPI
Meta
  • License Expression: 0BSD
    SPDX License Expression
  • Author: Kamil Monicz
  • Tags anyio , async , asyncio , client , dns , dns-cache , http , httpx , security , ssrf , ssrf-protection , trio , web-security
  • Requires: Python >=3.9
Classifiers

Release history Release notifications | RSS feed

This version

1.2.0

1.1.0

1.0.0

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

httpx_secure-1.2.0.tar.gz (18.8 kB view details)

Uploaded Source

Built Distribution

If you're not sure about the file name format, learn more about wheel file names.

httpx_secure-1.2.0-py3-none-any.whl (5.6 kB view details)

Uploaded Python 3

File details

Details for the file httpx_secure-1.2.0.tar.gz.

File metadata

  • Download URL: httpx_secure-1.2.0.tar.gz
  • Upload date:
  • Size: 18.8 kB
  • Tags: Source
  • Uploaded using Trusted Publishing? Yes
  • Uploaded via: twine/6.1.0 CPython/3.12.9

File hashes

Hashes for httpx_secure-1.2.0.tar.gz
Algorithm Hash digest
SHA256 6e4ec4fede8d19094e29312312d82e3468092c3cd8d53647d58c0f865cf8ec81
MD5 ef9ebbdd0918ac51ebf090b6ee8edc94
BLAKE2b-256 09c1a06452c56e05f2b5cb4771e7424099ba4c855466fecacaae894324c8f4b1

See more details on using hashes here.

Provenance

The following attestation bundles were made for httpx_secure-1.2.0.tar.gz:

Publisher: workflow.yaml on Zaczero/httpx-secure

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

File details

Details for the file httpx_secure-1.2.0-py3-none-any.whl.

File metadata

  • Download URL: httpx_secure-1.2.0-py3-none-any.whl
  • Upload date:
  • Size: 5.6 kB
  • Tags: Python 3
  • Uploaded using Trusted Publishing? Yes
  • Uploaded via: twine/6.1.0 CPython/3.12.9

File hashes

Hashes for httpx_secure-1.2.0-py3-none-any.whl
Algorithm Hash digest
SHA256 d97c806e4ba115c7b6e3f91c8e7f37d83823fae5d80f5e8f2fd86bf09f2888a7
MD5 ded9f2c46c94a1f44e21993e25dd1e24
BLAKE2b-256 aec838966b87dbb7e1f2dffcbb9fc6168580eb970c336c810ff8bf3554a33699

See more details on using hashes here.

Provenance

The following attestation bundles were made for httpx_secure-1.2.0-py3-none-any.whl:

Publisher: workflow.yaml on Zaczero/httpx-secure

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

Supported by

AWS Cloud computing and Security Sponsor Datadog Monitoring Depot Continuous Integration Fastly CDN Google Download Analytics Pingdom Monitoring Sentry Error logging StatusPage Status page