Passthrough api_base SSRF Guard

api_base URLs are DNS-resolved and screened against private, loopback and metadata addresses

passthrough / apassthrough check api_base from start to finish, so a public hostname can’t be pointed at an internal address when the connection is made.

Quick Start

1. Public endpoint — works

   from praisonai.capabilities import passthrough
   
   result = passthrough(
       endpoint="/v1/models",
       method="GET",
       api_base="https://api.openai.com",
       api_key="sk-proj-abc123",
   )
   print(result.status_code)

2. Localhost — rejected

   from praisonai.capabilities import passthrough
   
   try:
       passthrough(endpoint="/v1/models", method="GET", api_base="http://localhost:11434")
   except ValueError as e:
       print(e)  # api_base URL cannot be a localhost address (direct HTTP path)

How it works

1. The api_base hostname is resolved, and every A/AAAA record is checked. A public A record cannot hide a private AAAA record.
2. If any address is in a restricted class, the call raises ValueError before anything is sent.
3. The connection is pinned to the checked IP. The Host header and TLS SNI keep the original hostname, so DNS rebinding at connect time is blocked.
4. In apassthrough, DNS resolution runs in a worker thread (asyncio.to_thread), so the event loop is not blocked.

Rejected address classes

Only http and https schemes are accepted.

Error shape

Every error message starts with api_base URL, so you can filter logs for it:

Related