safehttp

Documentation

Overview

Package safehttp can be used for making http requests when the hostname is not trusted (user inputs). It will avoid SSRF by ensuring that the IP address which will connect is not a private address, or loopback. It also checks that the port is 80 or 443, not anything else.

Index

• Variables

Variables

var ClientWithKeepAlive = &http.Client{
	Transport: transportWithKeepAlive,
}

ClientWithKeepAlive is an http client that can be used to avoid SSRF. And it has keep-alive (contrary to safehttp.DefaultClient). The typical use case is moving a Cozy.

var DefaultClient = &http.Client{
	Timeout:   10 * time.Second,
	Transport: safeTransport,
}

DefaultClient is an http client that can be used instead of http.DefaultClient to avoid SSRF. It has the same default configuration, except it disabled keep-alive, as it is probably not useful in such cases.