safe-fetch
github.com/rehanfaisal/ssrf-safe-fetch- Category
- Developer Tools
- Rank
- No. 4199Tools index
Previous survey · No. 3984 ·
- Pricing
- Open Source
- Type
- TOOL
- Use case
- Security & Identity
- GitHub
- 1 stars
- Date
About
A single-file Python library for fetching user-supplied URLs without exposing an application to Server-Side Request Forgery. It uses only the standard library and checks the resolved address on every redirect hop, blocking requests that would otherwise reach internal services like cloud instance metadata endpoints from tools such as webhook testers, link previews, or image proxies.
At a glance
safe-fetch is a small Python wrapper that checks the destination before requesting a user-supplied URL and repeats the check after redirects. It is worth reading as an example of first-pass URL filtering.
Good fit
Developers who want to understand why a link previewer needs to check resolved addresses and redirects.
Consider something else when
Choose a fetcher with enforced egress controls if arbitrary hostile URLs are part of your threat model.
Start here
Review the included tests and add synthetic cases for a public hostname that resolves to a blocked address or redirects to one. Check the behavior without contacting a real internal service.
Cost and requirements
Single-file Python module using the standard library.
Limits to know
The code checks DNS, then opens the URL separately. An address can change between those steps, so the check alone does not close DNS rebinding.
Sources checked 2026-11-05. Source-based assessment.
Why it made the leaderboard
Gives developers a one-file, dependency-free way to safely fetch user-supplied URLs without exposing internal services or cloud metadata endpoints to SSRF, a common and often-missed vulnerability class.
Tags
Media
Comments (0)
No comments yet
Editorially curated, with community endorsements as a secondary signal. Corrections welcome.