Outbound URL policy (SSRF hardening) for httpclient and scheduler URL jobs.
Server config:
gingee.json → egress
Modes:
- protected (default): block loopback, private, link-local, metadata; allow public internet
- allowlist: only hosts matching allow_hosts (metadata still force-blocked)
- off: no checks (local dev only)
Engine-internal (not for sandboxed app require).- Description:
- Outbound URL policy (SSRF hardening) for httpclient and scheduler URL jobs.
Server config:
gingee.json→egressModes: -protected(default): block loopback, private, link-local, metadata; allow public internet -allowlist: only hosts matchingallow_hosts(metadata still force-blocked) -off: no checks (local dev only) Engine-internal (not for sandboxed app require).
- Outbound URL policy (SSRF hardening) for httpclient and scheduler URL jobs.
Server config:
Members
(inner, constant) METADATA_HOSTS
- Description:
- Well-known cloud metadata / internal names (always blocked except mode=off).
Well-known cloud metadata / internal names (always blocked except mode=off).
(inner) config :object
Type:
- object
(inner) logger :object|null
Type:
- object | null
Methods
(inner) applyConnectPin(axiosConfig, allowedResult) → {object}
- Description:
- Attach connect-time DNS pin onto an axios / http request config when `assertUrlAllowed` returned validated addresses.
Parameters:
| Name | Type | Description |
|---|---|---|
axiosConfig |
object | |
allowedResult |
Object | null |
Returns:
same config (mutated)
- Type
- object
(async, inner) assertUrlAllowed(urlString, optionsopt) → {Promise.<({ok: true, url: string, host: string, addresses: (Array|null)}|{ok: false, code: string, message: string, reason: string})>}
- Description:
- Assert a URL is allowed under egress policy. On success, may include `addresses` — validated IPs to pin at connect (H13).
Parameters:
| Name | Type | Attributes | Description | ||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
urlString |
string | ||||||||||
options |
object |
<optional> |
Properties
|
Returns:
- Type
- Promise.<({ok: true, url: string, host: string, addresses: (Array|null)}|{ok: false, code: string, message: string, reason: string})>
(async, inner) assertUrlAllowedNoDns(urlString) → {Promise.<object>}
- Description:
- Synchronous-ish helper for tests: classify without DNS.
Parameters:
| Name | Type | Description |
|---|---|---|
urlString |
string |
Returns:
- Type
- Promise.<object>
(inner) beforeRedirect(options)
- Description:
- Axios beforeRedirect hook: re-validate each hop (sync DNS via lookupSync).
Parameters:
| Name | Type | Description |
|---|---|---|
options |
object | axios redirect options (has hostname, protocol, href, etc.) |
(inner) classifyIp(ip) → {Object}
- Description:
- Classify an IP address for SSRF policy.
Parameters:
| Name | Type | Description |
|---|---|---|
ip |
string |
Returns:
- Type
- Object
(inner) createPinnedLookup(addresses) → {function}
- Description:
- Create a Node-style `lookup` that only returns pre-validated addresses. Prevents DNS rebinding between policy check and TCP connect (H13).
Parameters:
| Name | Type | Description |
|---|---|---|
addresses |
Array.<{address: string, family: number}> |
Returns:
- Type
- function
(inner) getMaxRedirects() → {number}
- Description:
- Max redirects for axios under current policy.
Returns:
- Type
- number
(inner) initServer(cfg, logRefopt)
- Description:
- Initialize egress policy from gingee.json.
Parameters:
| Name | Type | Attributes | Description |
|---|---|---|---|
cfg |
object | null | undefined | ||
logRef |
object |
<optional> |