safehttpx

library0.1.7pypypi✓ verified 33d ago

safehttpx is a small Python library designed to protect applications from Server Side Request Forgery (SSRF) attacks. It provides an asynchronous `safehttpx.get()` method, which wraps `httpx.AsyncClient.get()` while performing DNS validation using Google DNS and implementing mitigation for DNS rebinding attacks. The current version is 0.1.7, and releases are irregular, driven primarily by security updates and the needs of its primary consumer, Gradio.

http-networking auth-security

github ↗package ↗

Install & Compatibility

Where this runs

No compatibility data collected yet for this library.

Code

Verified usage

Verified import paths — ran on the pinned version, not inferred.

from safehttpx import get

This quickstart demonstrates how to use `safehttpx.get()` asynchronously. It attempts to fetch a valid external URL and then demonstrates how an attempt to access a local IP address (a common SSRF target) is blocked by default, raising a `ValueError`. Remember to run this in an async context.

import asyncio import safehttpx as sh async def fetch_safe_url(): try: response = await sh.get("https://huggingface.co") response.raise_for_status() # Raise an exception for HTTP errors print(f"Success: {response.status_code} - {response.url}") # Example of blocked internal IP await sh.get("http://127.0.0.1") except ValueError as e: print(f"Validation Error: {e}") except Exception as e: print(f"An unexpected error occurred: {e}") if __name__ == "__main__": asyncio.run(fetch_safe_url())

Debug

Known footguns

gotchaSetting `_transport=False` in `safehttpx.get()` explicitly bypasses all SSRF protections, effectively making the call equivalent to a raw `httpx.AsyncClient.get()`. This should only be used if you fully understand and accept the security implications.

gotcha`safehttpx.get()` is an asynchronous function. It must be `await`-ed within an `async` function. In a script, you'll need to use `asyncio.run()` to execute the async call.

gotchasafehttpx's DNS validation relies on Google DNS by default. While generally robust, highly restrictive network environments or specific corporate policies might require custom DNS resolvers. This could lead to legitimate external domains being blocked if Google DNS is unreachable or if local DNS records differ.

gotchasafehttpx primarily focuses on securing `GET` requests. While it wraps `httpx`, users who directly instantiate `httpx.AsyncClient` or use other HTTP methods (like `POST`, `PUT`) without explicit safehttpx wrappers might inadvertently bypass the SSRF protections for those requests. The `safehttpx` module currently only exposes a `get` method.

breakingAs `safehttpx` is a wrapper around `httpx`, it is implicitly affected by breaking changes in `httpx` (e.g., changes in redirect handling or SSL configuration). While `safehttpx` may pin `httpx` versions, custom environment setups could lead to mismatches.

Upgrade

Version history

Breaking-change detection hasn't run for this library yet.

Audit

Security & dependencies

CVE tracking and dependency tree are planned for a later release.

Agent activity

0 hits · last 30 days

No traffic data recorded yet.

Resources

githubhttps://github.com/gradio-app/safehttpx ↗

packagehttps://pypi.org/project/safehttpx/ ↗