Show HN: Drawbridge – Drop-In SSRF Protection for Python

1 points by logicx24 22 days ago · 0 comments · 1 min read

Drawbridge is a drop-in replacement for `requests` or `httpx` that provides comprehensive SSRF protection.

For every request, it will: 1. Resolve DNS first with single getaddrinfo() call 2. Validate all IPs, and reject if any resolved address is private/reserved 3. Pin the connection by rewriting the URL to validated IP, and sets the Host header and TLS SNI to original hostname 4. Re-validates on each redirect hop.

This blocks most SSRF attack methods: DNS rebinding, address obfuscation, and redirects.

Also see our launch post here: https://tachyon.so/blog/ssrfs-trickiest-issue

No comments yet.