Secure URL validation for web applications

Modern applications frequently fetch external webhook URLs, import remote avatar images, or unfurl preview links. When backend services fetch user-supplied URLs without isolated network routing, attackers can pivot through the application server to query internal cloud metadata services (e.g. 169.254.169.254), Kubernetes etcd clusters, or unauthenticated internal microservices.

Why Regular Expressions Fail

Developers routinely attempt to validate URLs using regex patterns like /^https?:\/\/[a-z0-9.-]+/i. These patterns fail because IP addresses can be expressed in multiple valid formats that standard URI parsers resolve directly to private network interfaces:

Zero-Trust Validation Architecture

To securely resolve external URLs, validation and request dispatch must be atomic. The socket connection itself must inspect resolved IP addresses before the HTTP handshake commences:

import http from 'http';
import https from 'https';
import ipaddr from 'ipaddr.js';
import dns from 'dns/promises';

// Prohibited IP ranges (RFC 1918, RFC 3927, Loopback, Cloud Metadata)
const BLOCKED_RANGES = [
  'unspecified',
  'broadcast',
  'linkLocal',
  'loopback',
  'private',
  'reserved',
];

export async function validateIpAddress(ip: string): Promise<boolean> {
  try {
    const addr = ipaddr.parse(ip);
    const range = addr.range();
    
    if (BLOCKED_RANGES.includes(range)) {
      return false;
    }
    
    // Explicit block for Cloud Provider Metadata (169.254.169.254)
    if (addr.toNormalizedString() === '169.254.169.254') {
      return false;
    }

    return true;
  } catch {
    return false;
  }
}

export async function safeResolveHost(hostname: string): Promise<string> {
  const addresses = await dns.lookup(hostname, { all: true });
  
  for (const record of addresses) {
    const isSafe = await validateIpAddress(record.address);
    if (!isSafe) {
      throw new Error(`Access to restricted address range is prohibited: ${record.address}`);
    }
  }
  
  return addresses[0].address;
}

For further security engineering advisories and deep-dive technical breakdowns, refer to the security research papers indexed on tirup.in.