{"categories":[{"label":"WWW/HTTP","url":"https://skillfed.io/packages/category/internet-www-http/4"},{"label":"Security","url":"https://skillfed.io/packages/category/security/2"}],"enrichment":{"capability":"Advocate wraps the requests library to prevent SSRF attacks by validating HTTP request destinations before connection, blocking access to internal addresses and handling DNS rebinding attacks.","skillfed_tags":["ssrf-prevention","requests-wrapper","abandoned"],"use_cases":["Proxy or webhook services that fetch URLs submitted by users, preventing attackers from targeting internal infrastructure.","Web scrapers or link-checking tools that process user-supplied URLs without exposing internal network resources.","API gateways or content aggregators that need to safely fetch remote resources while protecting backend systems.","Applications handling file downloads or image processing from user-provided URLs in multi-tenant environments.","Testing frameworks or security scanners that need to make controlled HTTP requests without accidentally hitting internal services."],"what_it_does":"Advocate is a wrapper around the requests library designed to prevent Server-Side Request Forgery (SSRF) attacks by validating HTTP request destinations before they are made. It intercepts connection attempts and checks them against configurable rules to block access to internal addresses, private IP ranges, and other potentially dangerous targets. The package handles DNS rebinding attacks by performing address validation at the socket level, ensuring that the address checked matches the one actually used for connection.\n\nThe package is most useful when your application makes HTTP requests on behalf of untrusted users or third parties\u2014scenarios where an attacker might try to manipulate URLs to access internal services, cloud metadata endpoints, or other restricted resources. Advocate aims to be a drop-in replacement for requests in many cases, offering both simple function-level wrappers and a subclassed Session with sensible defaults. It also provides an AddrValidator class for fine-grained control over which addresses are allowed or blocked.","worth_installing":"No. The project is archived and abandoned since 2023, with the last release in 2020. While the code is permissively licensed and has low install friction, the lack of maintenance means it will not receive security updates, bug fixes, or compatibility patches for modern Python and dependency versions. For new projects, consider actively maintained SSRF prevention libraries or implement request validation at the network/proxy layer instead."},"id":"advocate","links":{"html":"https://skillfed.io/packages/advocate","md":"https://skillfed.io/packages/advocate.md","pypi":"https://pypi.org/project/advocate/"},"maintenance":{"status":"abandoned"},"meta":{"latest_release":"2020-07-14","license_spdx":null,"license_treatment":"permissive","name":"advocate","python_support":"unspecified","summary":"A wrapper around the requests library for safely making HTTP requests on behalf of a third party"},"popularity":{"monthly_downloads":320794,"position":7632,"tier":"top_15000"},"security":{"n_vulnerabilities":0},"version":"1.0.0"}