Interface IWebSocketUrlValidator
- Namespace
- Virtufin.WebSocketManager.Services
- Assembly
- Virtufin.WebSocketManager.dll
SSRF prevention for caller-supplied WebSocket connection URLs. This
service has no authentication of its own (cluster-internal network is
the trust boundary for who may call it), but that says nothing about
what the service itself can be tricked into doing -- an unvalidated
Connect target lets any caller direct outbound WebSocket traffic
to arbitrary internal hosts, including cloud instance metadata
endpoints. Mirrors virtufin-workmanager's
WorkManager.ValidateCodeSourceUrlAsync/IsPrivateIpAddress,
which faces the identical risk shape for caller-supplied code-fetch
URLs.
public interface IWebSocketUrlValidatorMethods
ValidateAsync(Uri, CancellationToken)
Task ValidateAsync(Uri url, CancellationToken cancellationToken = default)Parameters
urlUricancellationTokenCancellationToken