Skip to main content
SSRF-guarded server-side URL fetching. The SSRF guard (tai42_kit.net.url_guard) resolves and validates each target host, and fetch_url is the httpx download built on it: while the guard is enabled (the default) that download is DNS-rebinding-safe, redirect-safe, and size-capped. The guard is reusable on its own by any caller that fetches a caller-supplied URL server-side over its own HTTP client. fetch_url is re-exported LAZILY (PEP 562): it pulls in httpx/httpcore, and a consumer of a lighter net utility (e.g. tai42_kit.net.request_body) must not drag that backend into its import graph merely by importing a sibling module. This is the same reason tai42_kit.net.jwt (which needs joserfc) stays out of this re-export.

​
UrlGuardError

tai42_kit.net.url_guard.UrlGuardError
Raised when a target host is unresolvable, non-public, over the size cap, or over-redirected. Covers a host that cannot be resolved or is rejected as non-public, a response that exceeds the guard’s size cap, and a redirect chain that exceeds max_redirects.

​
UrlGuardSettings

tai42_kit.net.url_guard.UrlGuardSettings
Policy for the SSRF guard on server-side URL fetches. Attributes

​
enforce_size

tai42_kit.net.url_guard.enforce_size
Raise UrlGuardError when nbytes exceeds the configured cap. A no-op when the guard is disabled. Never truncates — an over-cap response is refused loudly. Parameters

​
fetch_url

tai42_kit.net.fetch_url.fetch_url
Fetch the URL’s body and return (bytes, mime). mime is the response Content-Type header (None when absent). When the guard is enabled the request runs over _PinningTransport, which validates and pins every connection (initial request and each redirect hop that opens a new connection), and the body is size-capped while streaming. Raises rather than truncating an over-cap body or reaching a non-public host. When the guard is disabled a plain client is used, which caps nothing, pins nothing, and lets httpx follow redirects. Under the guard, redirects are followed one hop at a time rather than by httpx, which reads each intermediate body into memory in full before chasing Location. A hop carrying a body large enough to exhaust memory would slip past the cap that way, so each redirect response is closed unread — forgoing connection reuse for that hop — and only the terminal body is streamed and counted. Parameters

​
guard_enabled

tai42_kit.net.url_guard.guard_enabled
Return whether the SSRF guard is enabled (TAI_URL_GUARD_ENABLED).

​
resolve_and_validate

tai42_kit.net.url_guard.resolve_and_validate
Resolve host, reject non-public addresses, and return the first validated address. The returned address is the one to connect to (the “pin”). Resolving once and connecting to the returned address closes DNS-rebinding: the same lookup that is validated is the one the connection uses, so an attacker cannot answer public during the check and internal at connect time. Raises UrlGuardError if resolution fails or any address is blocked. Parameters

​
url_guard_settings

tai42_kit.net.url_guard.url_guard_settings
Return the process-wide UrlGuardSettings, cached after first load.