3 ms·
Some discussion about handling webhooks with evil URLs: http://blog.fanout.io/2014/01/27/how-to-safely-invoke-webhooks/ http://blog.fanout.io/2014/01/27/how-to-
by jkarneges 8y ago
Some discussion about handling webhooks with evil URLs: http://blog.fanout.io/2014/01/27/how-to-safely-invoke-webhooks/ http://blog.fanout.io/2014/01/27/how-to-safely-invoke-webhoo...
- nicolaslem 8y agoThe IP blacklisting section seems fragile to me. What about IPv6 or multiple A records? I would rather let the OS connect the way it prefers and once it is connected, check that the remote is a legit IP address before sending anything.
- jkarneges 8y agoIPv6: blacklist similar address ranges. Multiple A records: be sure to check against each record before connecting. Connecting first and then checking the remote IP before sending anything could work I suppose, but I think you'd still need to check against a blacklist.