safehttpx is a small Python library designed to protect applications from Server Side Request Forgery (SSRF) attacks. It provides an asynchronous `safehttpx.get()` method, which wraps `httpx.AsyncClient.get()` while performing DNS validation using Google DNS and implementing mitigation for DNS rebinding attacks. The current version is 0.1.7, and releases are irregular, driven primarily by security updates and the needs of its primary consumer, Gradio.
pip install safehttpxVerified import paths — ran on the pinned version, not inferred.
This quickstart demonstrates how to use `safehttpx.get()` asynchronously. It attempts to fetch a valid external URL and then demonstrates how an attempt to access a local IP address (a common SSRF target) is blocked by default, raising a `ValueError`. Remember to run this in an async context.
Avoid using `_transport=False` unless absolutely necessary and with a clear understanding of the risks. Ensure all URLs passed to `safehttpx.get()` are intended for public access.
Always use `await safehttpx.get(...)` within an `async` function. For top-level calls in scripts, wrap the async function call with `asyncio.run(your_async_function())`.
Ensure that Google DNS (8.8.8.8, 8.8.4.4) is reachable from your application's environment. If not, investigate network configuration or consider contributing to the library for custom DNS resolver options if needed.
Ensure all network requests that could be susceptible to SSRF are routed through `safehttpx.get()`. Do not assume other HTTP methods or direct `httpx` client usage inherit `safehttpx`'s protections.
Refer to the `httpx` changelog (e.g., v0.20.0 for redirect changes, v0.28.0 for SSL config changes) if unexpected behavior occurs. Ensure your `httpx` version is compatible with the `safehttpx` version you are using.