Security Overview

HTTPC is secure by default -- all security features work out of the box.

Security Feature Overview

Feature	Default	Description
TLS minimum version	TLS 1.2	Rejects TLS 1.0/1.1
SSRF protection	On	Blocks private IP connections
URL validation	On	Validates URL format and protocol
Header validation	On	Prevents CRLF injection
Content-Length strict checking	On	Prevents response smuggling
Cookie security validation	Optional	Validates cookie security attributes
Response body size limit	10MB	Prevents memory exhaustion
Decompressed body size limit	100MB	Prevents decompression bombs
Redirect limit	10 times	Prevents infinite redirects

TLS Security

cfg := httpc.DefaultConfig()
// Default TLS 1.2-1.3
cfg.Security.MinTLSVersion = tls.VersionTLS12
cfg.Security.MaxTLSVersion = tls.VersionTLS13

DANGER

InsecureSkipVerify is for testing only. Never set to true in production.

SSRF Protection

SSRF (Server-Side Request Forgery) is an attack where an attacker uses the server to make internal network requests.

// Default: blocks private IPs
cfg := httpc.DefaultConfig()
// AllowPrivateIPs = false -> blocks 127.0.0.1, 10.x, 192.168.x, etc.

// Exempt specific CIDRs (e.g. VPN, VPC)
cfg.Security.SSRFExemptCIDRs = []string{
    "10.0.0.0/8",       // VPC internal
    "100.64.0.0/10",    // Tailscale
}

// Secure preset: strongest SSRF protection
client, _ := httpc.New(httpc.SecureConfig())

Blocked IP Ranges

Range	Description
127.0.0.0/8	Loopback address
10.0.0.0/8	Class A private
172.16.0.0/12	Class B private
192.168.0.0/16	Class C private
169.254.0.0/16	Link-local
100.64.0.0/10	CGNAT (includes Alibaba Cloud metadata 100.100.100.200)
240.0.0.0/4	Class E reserved
::1/128	IPv6 loopback
fc00::/7	IPv6 unique local
fe80::/10	IPv6 link-local

The table above lists the main ranges; for the full list (including 0.0.0.0/8, TEST-NET, the IPv6 documentation prefix 2001:db8::/32, NAT64 64:ff9b::/96, etc.) see the source isPrivateOrReservedIP.

Header Validation

Automatically prevents CRLF injection and header smuggling:

// The following headers are rejected
httpc.WithHeader("X-Custom", "value\r\nInjected: header") // CRLF injection
httpc.WithHeader("X-Bad", "value\x00null")                // Control characters

Cookie Security

// Strict cookie security
cfg := httpc.DefaultConfig()
cfg.Security.CookieSecurity = httpc.StrictCookieSecurityConfig()
// Requires: Secure, HttpOnly, SameSite=Strict

Redirect Security

// Disable redirects (security-sensitive scenarios)
cfg := httpc.SecureConfig() // FollowRedirects = false

// Limit redirect domains
cfg := httpc.DefaultConfig()
cfg.Security.RedirectWhitelist = []string{
    "api.example.com",
    "auth.example.com",
}

Audit Middleware

auditMiddleware := httpc.AuditMiddleware(func(event httpc.AuditEvent) {
    // URL is masked (credentials removed)
    log.Printf("[AUDIT] %s %s -> %d (%v)",
        event.Method, event.URL, event.StatusCode, event.Duration)
})

cfg := httpc.DefaultConfig()
cfg.Middleware.Middlewares = []httpc.MiddlewareFunc{auditMiddleware}

Configurable Audit

auditCfg := &httpc.AuditMiddlewareConfig{
    Format:         "json",
    IncludeHeaders: true,
    MaskHeaders:    []string{"Authorization", "Cookie"},
    SanitizeError:  true,
}
auditMiddleware := httpc.AuditMiddlewareWithConfig(func(event httpc.AuditEvent) {
    data, _ := json.Marshal(event)
    log.Println(string(data))
}, auditCfg)

Next Steps

• SSRF Protection - SSRF protection in depth and configuration
• TLS and Certificate Pinning - TLS configuration and certificate pinning
• Production Checklist - Pre-launch checklist