--- title: "HTTP Guard" manual: "HTTP Guard" version: "main" permalink: "https://docs.typo3.org/permalink/netresearch/nr-http-guard:http-guard@main" source: "Index.rst" start: true rendered: "2026-10-18T12:36:26+00:00" --- # HTTP Guard {#http-guard} ![](Images/netresearch-underline.svg) Install and activate HTTP Guard to add server-side request forgery (SSRF) protection to TYPO3's standard HTTP client, `RequestFactory`. Existing calls through the registered factory are protected automatically; no application rewrite or custom policy configuration is needed. When an application fetches URLs from user input, imports or external payloads, the default `enforce` mode blocks private, loopback, cloud metadata and special-purpose destinations before a connection starts. DNS results and redirects are checked too. Allowed connections are bound to verified IP addresses. Version 0.1.4 is an alpha release. It includes the security core, the TYPO3 adapter, the address rules and this manual in **one** extension with the key `nr_http_guard`. A classic installation requires neither a Composer command nor an additional HTTP Guard package. ## Install and activate {#http-guard-start} For a Composer project, install the published 0.1 series and rebuild caches: **Installation in a TYPO3 project** ```bash composer require netresearch/nr-http-guard:^0.1 vendor/bin/typo3 cache:flush ``` Composer registers the extension automatically. For a classic installation, install `nr_http_guard` from [TER](https://extensions.typo3.org/extension/nr_http_guard), then activate it in the Extension Manager and rebuild caches. Default protection is active without endpoint configuration. See [Installation](https://docs.typo3.org/permalink/netresearch/nr-http-guard:installation@main) for requirements and diagnostics. Internal integrations need an endpoint profile and a client explicitly bound to that profile. Adding a profile does not grant ordinary RequestFactory calls access to internal destinations. ## Next steps {#http-guard-next} **📦 Installation** Check requirements and install with Composer or from TER. [Install HTTP Guard](https://docs.typo3.org/permalink/netresearch/nr-http-guard:installation@main) **⚙️ Configuration** Review policy fields and configure profiles for internal endpoints. [Configure policies](https://docs.typo3.org/permalink/netresearch/nr-http-guard:configuration@main) **🚀 Client APIs** Use bound PSR-18 clients and Public Fetch in your own project. [Explore the APIs](https://docs.typo3.org/permalink/netresearch/nr-http-guard:api@main) **🛠️ Operations** Diagnose requests and plan rollout, changes and rollback. [Operate HTTP Guard](https://docs.typo3.org/permalink/netresearch/nr-http-guard:operations@main) **🔒 Security** Understand DNS, transport, redirect checks and coverage limits. [Read the security boundaries](https://docs.typo3.org/permalink/netresearch/nr-http-guard:security@main) **💻 Development** Set up the development environment and run the verification tools. [Contribute to HTTP Guard](https://docs.typo3.org/permalink/netresearch/nr-http-guard:development@main) ## Manual {#http-guard-manual} - [Installation](https://docs.typo3.org/permalink/netresearch/nr-http-guard:installation-1@main) - [Configuration](https://docs.typo3.org/permalink/netresearch/nr-http-guard:configuration-1@main) - [General options](https://docs.typo3.org/permalink/netresearch/nr-http-guard:general-options@main) - [Endpoint profiles](https://docs.typo3.org/permalink/netresearch/nr-http-guard:endpoint-profiles@main) - [Using clients](https://docs.typo3.org/permalink/netresearch/nr-http-guard:using-clients@main) - [Operations](https://docs.typo3.org/permalink/netresearch/nr-http-guard:operations-1@main) - [Understanding denials](https://docs.typo3.org/permalink/netresearch/nr-http-guard:understanding-denials@main) - [Security model and limits](https://docs.typo3.org/permalink/netresearch/nr-http-guard:security-model-and-limits@main) - [Development and tests](https://docs.typo3.org/permalink/netresearch/nr-http-guard:development-and-tests@main) - [Licenses and data](https://docs.typo3.org/permalink/netresearch/nr-http-guard:licenses-and-data@main) - [Requirements and security invariants](https://docs.typo3.org/permalink/netresearch/nr-http-guard:requirements-and-security-invariants@main) - [Verification report](https://docs.typo3.org/permalink/netresearch/nr-http-guard:verification-report-1@main) - [Dependencies and security status](https://docs.typo3.org/permalink/netresearch/nr-http-guard:dependencies-and-security-status@main) - [Repository assessment](https://docs.typo3.org/permalink/netresearch/nr-http-guard:repository-assessment@main) - [Assessment reconciliation](https://docs.typo3.org/permalink/netresearch/nr-http-guard:assessment-reconciliation-1@main) - [Release provenance and integrity](https://docs.typo3.org/permalink/netresearch/nr-http-guard:release-provenance-and-integrity@main) - [Architecture decision records](https://docs.typo3.org/permalink/netresearch/nr-http-guard:architecture-decision-records@main) - [ADR-0001: Protect the outbound HTTP path, not a PHP firewall](https://docs.typo3.org/permalink/netresearch/nr-http-guard:adr-0001-protect-the-outbound-http-path-not-a-php-firewall@main) - [ADR-0002: A shared library instead of a Vault dependency for every extension](https://docs.typo3.org/permalink/netresearch/nr-http-guard:adr-0002-a-shared-library-instead-of-a-vault-dependency-for-every-extension@main) - [ADR-0003: Two middleware boundaries and a controlled terminal transport](https://docs.typo3.org/permalink/netresearch/nr-http-guard:adr-0003-two-middleware-boundaries-and-a-controlled-terminal-transport@main) - [ADR-0004: Enforce by default, Observe only as a visible migration mode](https://docs.typo3.org/permalink/netresearch/nr-http-guard:adr-0004-enforce-by-default-observe-only-as-a-visible-migration-mode@main) - [ADR-0005: Bind the checked address set directly to the connection](https://docs.typo3.org/permalink/netresearch/nr-http-guard:adr-0005-bind-the-checked-address-set-directly-to-the-connection@main) - [ADR-0006: Authorize internal access through client-bound endpoint grants](https://docs.typo3.org/permalink/netresearch/nr-http-guard:adr-0006-authorize-internal-access-through-client-bound-endpoint-grants@main) - [ADR-0007: Controlled cURL only; no proxies or PHP streams in v1](https://docs.typo3.org/permalink/netresearch/nr-http-guard:adr-0007-controlled-curl-only-no-proxies-or-php-streams-in-v1@main) - [ADR-0008: Check every redirect hop and bind credentials to their origin](https://docs.typo3.org/permalink/netresearch/nr-http-guard:adr-0008-check-every-redirect-hop-and-bind-credentials-to-their-origin@main) - [ADR-0009: One canonical target parser and a versioned address corpus](https://docs.typo3.org/permalink/netresearch/nr-http-guard:adr-0009-one-canonical-target-parser-and-a-versioned-address-corpus@main) - [ADR-0010: Allow address memoization; isolate authorization and connection pooling](https://docs.typo3.org/permalink/netresearch/nr-http-guard:adr-0010-allow-address-memoization-isolate-authorization-and-connection-pooling@main) - [ADR-0011: Retain Vault streaming without falling back to the PHP stream handler](https://docs.typo3.org/permalink/netresearch/nr-http-guard:adr-0011-retain-vault-streaming-without-falling-back-to-the-php-stream-handler@main) - [ADR-0012: Stable denial reasons without new secret leaks](https://docs.typo3.org/permalink/netresearch/nr-http-guard:adr-0012-stable-denial-reasons-without-new-secret-leaks@main) - [ADR-0013: Explicit migration instead of silently reinterpreting existing allowlists](https://docs.typo3.org/permalink/netresearch/nr-http-guard:adr-0013-explicit-migration-instead-of-silently-reinterpreting-existing-allowlists@main) - [ADR-0014: Qualify security through target-contact and regression evidence](https://docs.typo3.org/permalink/netresearch/nr-http-guard:adr-0014-qualify-security-through-target-contact-and-regression-evidence@main) - [ADR-0015: One installable extension](https://docs.typo3.org/permalink/netresearch/nr-http-guard:adr-0015-one-installable-extension@main) - [ADR-0016: Public RequestFactory as the URI boundary](https://docs.typo3.org/permalink/netresearch/nr-http-guard:adr-0016-public-requestfactory-as-the-uri-boundary@main) - [ADR-0017: Controlled DNS queries for the default resolver](https://docs.typo3.org/permalink/netresearch/nr-http-guard:adr-0017-controlled-dns-queries-for-the-default-resolver@main) - [ADR-0018: One cURL factory creation per transfer lease](https://docs.typo3.org/permalink/netresearch/nr-http-guard:adr-0018-one-curl-factory-creation-per-transfer-lease@main) - [Changelog](https://docs.typo3.org/permalink/netresearch/nr-http-guard:changelog-1@main) ## Scope {#http-guard-scope} The extension does not replace a network firewall. It controls the documented TYPO3 HTTP path after registration and the clients created by its factories. Incoming PSR-15 middleware, early bootstrap requests, third-party SDK clients, direct cURL calls and custom socket connections require separate integration. See [Coverage and trust boundary](https://docs.typo3.org/permalink/netresearch/nr-http-guard:security-coverage@main) for the complete scope. The optional nr-vault adaptation is a separate migration. The global extension does not protect Vault automatically. The API chapter links the recorded reference patch and its historical evidence under [Optional nr-vault migration](https://docs.typo3.org/permalink/netresearch/nr-http-guard:api-vault@main). This manual is sufficient to install and operate the extension. **\[n\] A Netresearch extension** ![](Images/netresearch-underline.svg) Professional TYPO3 development, integration and consulting by Netresearch DTT GmbH. [netresearch.de](https://www.netresearch.de)