Refuse private targets before calling a customer URL

At a glanceCopy Anchor Link

• Who: Developers whose server sends requests to URLs that users or customers supply (webhooks, callbacks).
• What: Reject non-http(s) URLs and loopback, private, link-local, cloud-metadata and special-use hosts before any request is made.
• Use when: When saving or sending to a user-supplied URL; keep allowPrivate for local development only.
• Avoid when: As your only defense. It does not resolve DNS, so DNS rebinding is not covered; also pin the resolved address, or send through an egress proxy.
• See also: Sign and verify webhook deliveries

InstallCopy Anchor Link

pnpm add @zedtech/zedkit-server

Latest: 1.3.1 (via changesets).

ExampleCopy Anchor Link

import { checkEndpointUrl } from "@zedtech/zedkit-server";
const check = checkEndpointUrl(input, { allowPrivate: process.env.NODE_ENV !== "production" });
if (!check.ok) return badRequest(check.error.message);

Wraps: (none)