The Microsoft AntiSSRF Library for Node.js is a security-developed, exhaustively-tested library that provides robust URL validation to protect Node.js applications from Server-Side Request Forgery (SSRF) vulnerabilities. It integrates seamlessly with Node.js HTTP/HTTPS agents, allowing developers to secure outbound HTTP requests with minimal code changes.
The AntiSSRF Library provides validation for different scenarios based on your trust requirements:
| Use Case | Description | Documentation Link |
|---|---|---|
| General Case | The untrusted URL can belong to any domain or an untrusted domain. | AntiSSRFPolicy |
| Azure Key Vault Domain | The untrusted URL must be an Azure Key Vault endpoint. | URIValidator.inAzureKeyVaultDomain |
| Azure Storage Domain | The untrusted URL must be an Azure Storage endpoint. | URIValidator.inAzureStorageDomain |
| Allowlist of Trusted Domains | The untrusted URL must belong to a specific, trusted domain. | URIValidator.inDomain |
-
SSRF Attack Prevention - Blocks malicious server-side request forgery attempts
-
Private Network Protection - Separate built-in configuration options for internal vs. external address HTTP clients
-
DNS Rebinding Protection - Guards against DNS-based attacks
-
Redirect Protection - Re-validates on all redirects to prevent bypass attempts
-
Protocol Validation - Ensures only safe protocols are used
-
Fully Customizable - Configure domain allowlists, IP ranges, headers, and validation policies
Explore our comprehensive documentation to get the most out of Microsoft AntiSSRF:
- Microsoft AntiSSRF Documentation
- Quick Start Guide
- Security Best Practices
- Frequently Asked Questions
- Changelog
We welcome feedback and contributions from the community! Here's how you can get involved:
- Report Issues: GitHub Issues - Report bugs or request new features
- Contribute: Contributing Guide - Learn how to contribute to the project
- Contact: antissrf-oss@microsoft.com - Direct email for questions and feedback
For support inquiries, contact antissrf-oss@microsoft.com.