Meziantou.FrameworkServerSideRequestForgeryClientHandler Class
An HTTP message handler that applies SSRF protection to a SocketsHttpHandler and rejects the requests that would bypass it over HTTP/3.
public sealed class ServerSideRequestForgeryClientHandler : DelegatingHandlerRemarks
SocketHttpHandlerServerSideRequestForgeryExtensions.ConfigureSsrf validates a destination from SocketsHttpHandler.ConnectCallback, which the runtime uses only for TCP connections. An HTTP/3 connection is established over QUIC and never reaches it, so a handler that allows HTTP/3 is not protected. Prefer this handler over calling ConfigureSsrf directly.
Example
var options = new ServerSideRequestForgeryOptions();
var handler = new ServerSideRequestForgeryClientHandler(new SocketsHttpHandler { UseProxy = false }, options);
using var client = new HttpClient(handler, disposeHandler: true);
// Requests to a loopback or private address are rejected before connecting
var exception = await Assert.ThrowsAsync<HttpRequestException>(() => client.GetAsync(new Uri("https://127.0.0.1/")));
Assert.IsType<ServerSideRequestForgeryException>(exception.InnerException);- Inheritance
DelegatingHandlerServerSideRequestForgeryClientHandler
Constructors
| Name | Description |
|---|---|
| ServerSideRequestForgeryClientHandler(SocketsHttpHandler, ServerSideRequestForgeryOptions) | Initializes a new instance of the ServerSideRequestForgeryClientHandler class. |
ServerSideRequestForgeryClientHandler(SocketsHttpHandler, ServerSideRequestForgeryOptions)
ServerSideRequestForgeryClientHandler.csInitializes a new instance of the ServerSideRequestForgeryClientHandler class.
public ServerSideRequestForgeryClientHandler(SocketsHttpHandler innerHandler, ServerSideRequestForgeryOptions options)Parameters
innerHandlerSocketsHttpHandler- The handler that establishes the connections. SSRF protection is configured on it.
optionsServerSideRequestForgeryOptions- The SSRF policy to apply.