10 lines
969 B
Markdown
10 lines
969 B
Markdown
# Network and SSRF security
|
|
|
|
* Use HTTPS and never disable certificate or TLS validation.
|
|
* Restrict inbound and outbound access to required ports, interfaces, hosts, and protocols.
|
|
* Treat user-controlled URLs as dangerous. Allowlist schemes and destinations, reject loopback, link-local, private, and cloud metadata ranges unless explicitly needed, and validate the resolved destination.
|
|
* Revalidate every redirect and DNS resolution to prevent redirects, rebinding, or mixed-address answers from bypassing destination restrictions. Disable automatic redirects when they cannot be safely checked.
|
|
* Set connection and overall timeouts, response-size limits, bounded concurrency, bounded retries, and cancellation for remote operations.
|
|
* Avoid forwarding ambient credentials, cookies, or authorization headers to a new host or redirect target.
|
|
* Use controlled egress where possible and avoid exposing internal error details or response bodies from remote services.
|