Skip to content

docs(deployment): document SSRF guard configuration - #4423

Open
stevenvegt wants to merge 2 commits into
masterfrom
docs/ssrf-protection
Open

docs(deployment): document SSRF guard configuration#4423
stevenvegt wants to merge 2 commits into
masterfrom
docs/ssrf-protection

Conversation

@stevenvegt

@stevenvegt stevenvegt commented Jul 27, 2026 •
edited
Loading

Copy link
Copy Markdown
Member

What

Deployment documentation for the strict-mode SSRF guard introduced in #4420.

  • Adds an "Outbound HTTP and SSRF protection" section to the security considerations page. It explains what the guard blocks (non-public addresses per the IANA special-purpose registries, cloud metadata endpoints per the OWASP SSRF prevention cheat sheet, HTTPS-to-HTTP redirect downgrades), shows the error message a blocked request produces, and documents how to configure http.client.allowedinternalcidrs and http.client.deniedcidrs in production, including deny-over-allow precedence.
  • Links the fix(http): block SSRF to non-public addresses in strict mode #4420 release notes entry to the new section.

Backports

Intended to be combined with #4420 in the backports to 5.4 and 6.2.

@stevenvegt
docs(deployment): document SSRF guard configuration
536315f 
Add an SSRF section to the security considerations page explaining the
strict-mode outbound guard and how to configure allowedinternalcidrs and
deniedcidrs in production. Link to it from the release notes entry.

Assisted-by: AI
@qltysh

qltysh Bot commented Jul 27, 2026

Copy link
Copy Markdown
Contributor

Qlty


Coverage Impact

This PR will not change total coverage.

🚦 See full report on Qlty Cloud »

🛟 Help

  • Diff Coverage: Coverage for added or modified lines of code (excludes deleted files). Learn more.

  • Total Coverage: Coverage for the whole repository, calculated as the sum of all File Coverage. Learn more.

  • File Coverage: Covered Lines divided by Covered Lines plus Missed Lines. (Excludes non-executable lines including blank lines and comments.)

    • Indirect Changes: Changes to File Coverage for files that were not modified in this PR. Learn more.

This was referenced Jul 27, 2026
Open
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@Dirklectisch Dirklectisch Dirklectisch approved these changes
@woutslakhorst woutslakhorst Awaiting requested review from woutslakhorst woutslakhorst is a code owner
@reinkrul reinkrul Awaiting requested review from reinkrul reinkrul is a code owner
@gerardsn gerardsn Awaiting requested review from gerardsn gerardsn is a code owner
@JorisHeadease JorisHeadease Awaiting requested review from JorisHeadease JorisHeadease is a code owner

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@stevenvegt @Dirklectisch