SSRF-Safe Webhook Fetch

A drop-in outbound fetch for buyer-supplied URLs that closes the three ways an SSRF guard is usually bypassed: a hostname that resolves to a private address, a redirect that lands somewhere the original check approved, and DNS rebinding between the check and the connection.

The common implementation blocks a denylist of literal addresses. That stops a copy-pasted exploit and nothing else, because the attacker controls DNS. Here, resolution happens once and the connection is pinned to the address that was checked, redirects are re-validated at every hop, and the allow decision is made on resolved addresses rather than on the string a user typed.

The failure this prevents is not a crash. It is a webhook that quietly fetches a cloud metadata endpoint and returns credentials in the response body.

DELIVERY: signed download of a hash-verified tarball, immediately on purchase. Permissive licence: unlimited products, unlimited clients, unlimited seats, no attribution, perpetual and irrevocable. One restriction, do not republish the source as source.

Interface

What you call, and what comes back. Types and signatures only — the implementation ships with the source.

  export function isPrivateIp(ipRaw: string): boolean;
  export async function assertSafeWebhookUrl(raw: string): Promise<;