2026-09-19 · 8 min read
- url
- security
- ssrf
A hierarchical URL authority can contain user information before an at-sign, followed by the host and optional port. Human readers often focus on a familiar name at the left, so a URL can look trusted while directing the connection to a different host after the at-sign.
Security decisions based on prefixes, suffixes, regular expressions, or substring searches are vulnerable to this confusion and to percent encoding, Unicode, IPv6 syntax, alternative ports, and parser differences.
Adopt one canonical parser boundary
Parse the complete input with the same standards-aware URL implementation used for the network request. Reject parse errors, disallowed schemes, fragments where irrelevant, and username or password fields unless the feature explicitly supports them.
- Validate the parsed hostname, never the display string.
- Normalize default and explicit ports under one policy.
- Handle bracketed IPv6 literals as host values.
- Reject backslash and delimiter ambiguities according to the parser profile.
Build a destination allowlist after parsing
Compare canonical hostnames or addresses against exact allowed destinations and resolve DNS under an SSRF policy appropriate to the application. Public-looking names can resolve to private addresses, and redirects can cross from an allowed host to a blocked one.
Apply the policy to every redirect hop and the final connection address where the networking stack permits it. Protect against DNS changes between validation and connection with platform-supported controls rather than repeated string checks.
Keep credentials out of transit and logs
Client libraries differ in whether URL userinfo becomes an Authorization header, is rejected, or is retained during redirects. Define one behavior, prohibit forwarding credentials to a different authority, and prefer explicit credential configuration over embedding secrets in URLs.
- Redact username and password before logs and analytics.
- Do not echo rejected URLs containing credentials.
- Strip sensitive query data under a separate policy.
- Render the effective hostname clearly in confirmation interfaces.
Run cross-parser adversarial fixtures
Use Flashman's URL tool for synthetic authorities, diff for parsed component outputs, Base64 for harmless Basic-auth examples, JSON formatter for allowlist fixtures, and case converter for hostname policy checks.
Test userinfo, multiple at-signs, percent-encoded delimiters, Unicode and Punycode, IPv6, ports, backslashes, empty hosts, fragments, redirects, DNS rebinding defenses, private ranges, redaction, and every browser, server, proxy, and HTTP client in the path.