Constrain URL fetches in import and preview features
Define which destinations an application may fetch. Review URL parsing, resolved addresses, redirects, response limits, and the worker's network access.
A URL import feature asks your server to make a request on someone else's behalf. Review the authority of that server before reviewing the URL text. A worker that can reach private services has a different boundary from a browser that loads a public image.
OWASP's SSRF guidance covers destination validation and network controls. The following fetch contract is a proposed implementation review artifact. It should be completed for each feature, not applied as a universal regular expression.
Define the permitted fetch contract
Decide whether the feature needs a small list of providers or arbitrary public destinations. Prefer a provider identifier when a user does not need to supply a complete URL. Record who may initiate a fetch and which account receives its result.
| Boundary | Required decision | Evidence |
|---|---|---|
| URL syntax | Allowed schemes, ports, and credentials | Parsed-value tests |
| Destination | Approved host or address policy | Resolved-address rejection cases |
| Redirect | Disabled or validated at every hop | Controlled redirect-chain result |
| Request | Allowed method and headers | No ambient service credentials |
| Response | Byte, time, and content limits | Bounded failure result |
Do not forward the user's browser cookies or the worker's internal authorization headers to the destination. Keep fetch credentials specific to an approved integration.
Check resolution and connection together
A textual hostname check is incomplete if the connection later uses an unchecked address. Review the actual resolver and HTTP client behavior, including redirects, proxies, and connection reuse. Apply the destination policy to the network path that is used, not only to an earlier parsed string.
Use controlled endpoints for tests. Simulate a redirect into a disallowed destination without contacting real internal metadata or unrelated services. Record whether the request was blocked before a connection was made. This is more useful than collecting a response from a prohibited target.
Bound failures and stored results
Enforce limits while reading the response rather than trusting a declared length. Define cancellation and cleanup when the remote endpoint stalls or returns unsuitable data. A failed preview should not leave a reusable partial file or a job that retries forever.
Review the result-serving path separately. Downloading bytes safely does not make them safe to render as application HTML. Save the destination decision, worker network policy, timeout result, and output handling rule together. Recheck this contract when an integration adds redirects, authentication, or a new proxy layer.
Find the gaps before your next launch
Use the release checklist to identify changed security boundaries and missing evidence. Discuss the application paths you want reviewed before launch.