---
title: "ADR-0001: Protect the outbound HTTP path, not a PHP firewall"
manual: "HTTP Guard"
version: "main"
permalink: "https://docs.typo3.org/permalink/netresearch/nr-http-guard:adr-0001@main"
source: "Adr/ADR-0001-ScopeAndTrustBoundaries.rst"
rendered: "2026-10-18T14:31:38+00:00"
---

# ADR-0001: Protect the outbound HTTP path, not a PHP firewall {#adr-0001}

-   *Status:* Historical proposal (original status: Proposed)
-   *Date:* 2026-10-08
-   *Original decision makers:*

    Project architecture/security owners; approval
    still pending in the original proposal.

-   *Requirements:* HG-001, HG-002, HG-018, HG-039, HG-042
-   *Original supersession:* None; a new decision for the proposed product.

> [!NOTE]
> This is the full English translation of the historical proposal dated
> 2026-10-08, originally Proposed. Its pending approval is historical and
> creates no additional alpha approval gate. Current
> [Security model and limits](https://docs.typo3.org/permalink/netresearch/nr-http-guard:security@main), [Development and tests](https://docs.typo3.org/permalink/netresearch/nr-http-guard:development@main), [Verification report](https://docs.typo3.org/permalink/netresearch/nr-http-guard:verification-report@main) and
> [Requirements and security invariants](https://docs.typo3.org/permalink/netresearch/nr-http-guard:development-requirements@main) describe the operative scope and evidence.
>
> The later single-package decision is recorded in [ADR-0015: One installable extension](https://docs.typo3.org/permalink/netresearch/nr-http-guard:adr-0015@main).

## Context {#adr-0001-context}

An untrusted URL can cause the server to access an internal target. The normal
TYPO3 HTTP stack provides a suitable common intervention point. Other PHP
clients and direct sockets also exist; a handler replaced for an individual
request can bypass middleware. Core does not provide a process sandbox.

Sources: `[S01-S03, S18]`.

## Decision {#adr-0001-decision}

The product protects only documented, verified send paths: the integrated
default stack and explicitly integrated clients. The guard must deny access
before contact with a disallowed target. DNS queries to the configured
resolver are separate; the guard does not promise to send no network packets
at all.

Attackers may influence URLs, responses and DNS in their own zones. Installed
PHP code, policy files, TLS/resolver configuration and the operating system
form the trusted base. Endpoint grants prevent accidental expansion of
permissions, but do not protect against malicious code in the same process.
The guard also does not authorize individual paths or records on an allowed
server.

Documentation and diagnostics use "global" only to mean the covered TYPO3
stack. Outbound firewall rules and service authentication remain complementary
controls.

## Rejected alternatives {#adr-0001-rejected-alternatives}

-   **Process-wide network blocking in PHP:** cannot be achieved without
    controlling every network function.
-   **URL syntax validation alone:** controls neither DNS nor the actual
    connection.
-   **Network firewall alone:** valuable, but does not by itself provide
    separate permissions for individual application clients.

## Consequences {#adr-0001-consequences}

The protection promise is measurable and not misleading. SDKs without an
integration remain a deliberate coverage gap; migrating them requires their
own adapters. Operations must inventory both levels.

## Evidence and acceptance in the original proposal {#adr-0001-verification-and-acceptance}

`T001, T003, T035, T074, T077`. Details and expected results are in
[Original verification specification](https://github.com/netresearch/typo3_http_guard/blob/3f929ae8794ca04ab3dd25627e94d601a2db23e0/specification/specs/06-verification.md). These tests were specified, not
executed as part of the original documentation delivery.

## Reasons to reconsider {#adr-0001-reassessment-trigger}

A new integration or an expanded promise requires its own transport evidence.
A future process/network sandbox is a separate product objective.

## Related documents {#adr-0001-related-documents}

[Original ADR](https://github.com/netresearch/typo3_http_guard/blob/3f929ae8794ca04ab3dd25627e94d601a2db23e0/specification/adr/ADR-0001-schutzumfang-und-vertrauensgrenzen.md), [Original product requirements](https://github.com/netresearch/typo3_http_guard/blob/3f929ae8794ca04ab3dd25627e94d601a2db23e0/specification/specs/01-product-requirements.md), [Original security model](https://github.com/netresearch/typo3_http_guard/blob/3f929ae8794ca04ab3dd25627e94d601a2db23e0/specification/specs/02-security-model.md),
[Original architecture](https://github.com/netresearch/typo3_http_guard/blob/3f929ae8794ca04ab3dd25627e94d601a2db23e0/specification/specs/03-architecture.md) and [Original source catalogue](https://github.com/netresearch/typo3_http_guard/blob/3f929ae8794ca04ab3dd25627e94d601a2db23e0/specification/specs/08-evidence-and-sources.md) (`S01-S23`),
plus the [ADR index](https://docs.typo3.org/permalink/netresearch/nr-http-guard:adr-index@main). [Original sources](https://docs.typo3.org/permalink/netresearch/nr-http-guard:adr-original-sources@main) explains
the immutable source index.