HTTP Guard

Install and activate HTTP Guard to add server-side request forgery (SSRF) protection to TYPO3's standard HTTP client, RequestFactory. Existing calls through the registered factory are protected automatically; no application rewrite or custom policy configuration is needed.

When an application fetches URLs from user input, imports or external payloads, the default enforce mode blocks private, loopback, cloud metadata and special-purpose destinations before a connection starts. DNS results and redirects are checked too. Allowed connections are bound to verified IP addresses.

Version 0.1.4 is an alpha release. It includes the security core, the TYPO3 adapter, the address rules and this manual in one extension with the key nr_http_guard. A classic installation requires neither a Composer command nor an additional HTTP Guard package.

Install and activate

For a Composer project, install the published 0.1 series and rebuild caches:

Installation in a TYPO3 project

composer require netresearch/nr-http-guard:^0.1
vendor/bin/typo3 cache:flush

Composer registers the extension automatically. For a classic installation, install nr_http_guard from TER, then activate it in the Extension Manager and rebuild caches. Default protection is active without endpoint configuration. See Installation for requirements and diagnostics.

Internal integrations need an endpoint profile and a client explicitly bound to that profile. Adding a profile does not grant ordinary RequestFactory calls access to internal destinations.

Next steps

📦 Installation

Check requirements and install with Composer or from TER.

Install HTTP Guard

⚙️ Configuration

Review policy fields and configure profiles for internal endpoints.

Configure policies

🚀 Client APIs

Use bound PSR-18 clients and Public Fetch in your own project.

Explore the APIs

🛠️ Operations

Diagnose requests and plan rollout, changes and rollback.

Operate HTTP Guard

🔒 Security

Understand DNS, transport, redirect checks and coverage limits.

Read the security boundaries

💻 Development

Set up the development environment and run the verification tools.

Contribute to HTTP Guard

Manual

Scope

The extension does not replace a network firewall. It controls the documented TYPO3 HTTP path after registration and the clients created by its factories. Incoming PSR-15 middleware, early bootstrap requests, third-party SDK clients, direct cURL calls and custom socket connections require separate integration. See Coverage and trust boundary for the complete scope.

The optional nr-vault adaptation is a separate migration. The global extension does not protect Vault automatically. The API chapter links the recorded reference patch and its historical evidence under Optional nr-vault migration. This manual is sufficient to install and operate the extension.

[n] A Netresearch extension

Professional TYPO3 development, integration and consulting by Netresearch DTT GmbH.

netresearch.de