advocate
A wrapper around the requests library for safely making HTTP requests on behalf of a third party
Decision gist · record as of 2026-08-14
No. The project is archived and abandoned since 2023, with the last release in 2020. While the code is permissively licensed and has low install friction, the lack of maintenance means it will not receive security updates, bug fixes, or compatibility patches for modern Python and dependency versions. For new projects, consider actively maintained SSRF prevention libraries or implement request validation at the network/proxy layer instead.AI-flagged interpretation of the facts on this page — verify before relying
Before you install
- Officially supported on CPython 2.7+, CPython 3.4+, and PyPy 2; IPv6 support is incomplete and disabled by default.
- Low install friction with a pure-Python wheel, but the project is archived and abandoned as of 2023-08-31, with no releases since 2020-07-14.
- The seven runtime dependencies (ndg-httpsclient, netifaces, pyasn1, pyopenssl, requests, six, urllib3) are stable but the package itself receives no maintenance.
License · maintenance · safety
Apache 2 (permissive) — Licensed under Apache 2 (permissive), so you can use it freely in commercial and open-source projects without copyleft obligations, but you must retain license notices.
last release 2020-07-14 (2222 days) · last repo commit 2023-08-31 · 96 stars · archived
0 known vulnerabilities (OSV.dev, 2026-08-14) · 320,794 downloads/mo, #7,632 on PyPI
Alternatives
Verify before relying
pip install advocate
import advocate
response = advocate.get("http://example.com/")
# Or with a session and custom validation:
from advocate import AddrValidator, Session
validator = AddrValidator(hostname_blacklist={"*.internal"})
sess = Session(validator=validator)
response = sess.get("http://example.com/")- Whether the abandoned status and lack of maintenance since 2020 pose a security risk for new deployments in modern threat landscapes.
- How well the package's SSRF protections hold up against contemporary attack vectors not documented in the fact sheet.
- Compatibility with modern versions of requests and its transitive dependencies beyond what the classifiers indicate.
What it is and what it does
Advocate is a wrapper around the requests library designed to prevent Server-Side Request Forgery (SSRF) attacks by validating HTTP request destinations before they are made. It intercepts connection attempts and checks them against configurable rules to block access to internal addresses, private IP ranges, and other potentially dangerous targets. The package handles DNS rebinding attacks by performing address validation at the socket level, ensuring that the address checked matches the one actually used for connection.
The package is most useful when your application makes HTTP requests on behalf of untrusted users or third parties—scenarios where an attacker might try to manipulate URLs to access internal services, cloud metadata endpoints, or other restricted resources. Advocate aims to be a drop-in replacement for requests in many cases, offering both simple function-level wrappers and a subclassed Session with sensible defaults. It also provides an AddrValidator class for fine-grained control over which addresses are allowed or blocked.
Use it for
- Proxy or webhook services that fetch URLs submitted by users, preventing attackers from targeting internal infrastructure.
- Web scrapers or link-checking tools that process user-supplied URLs without exposing internal network resources.
- API gateways or content aggregators that need to safely fetch remote resources while protecting backend systems.
- Applications handling file downloads or image processing from user-provided URLs in multi-tenant environments.
- Testing frameworks or security scanners that need to make controlled HTTP requests without accidentally hitting internal services.
Worth the install?
AI-flagged interpretation of the facts on this page. Verify before relying on it.
No.
The project is archived and abandoned since 2023, with the last release in 2020. While the code is permissively licensed and has low install friction, the lack of maintenance means it will not receive security updates, bug fixes, or compatibility patches for modern Python and dependency versions. For new projects, consider actively maintained SSRF prevention libraries or implement request validation at the network/proxy layer instead.
Install
advocate on PyPI
Before you install
Low install friction with a pure-Python wheel, but the project is archived and abandoned as of 2023-08-31, with no releases since 2020-07-14. The seven runtime dependencies (ndg-httpsclient, netifaces, pyasn1, pyopenssl, requests, six, urllib3) are stable but the package itself receives no maintenance.
Officially supported on CPython 2.7+, CPython 3.4+, and PyPy 2; IPv6 support is incomplete and disabled by default.
License in practice
Licensed under Apache 2 (permissive), so you can use it freely in commercial and open-source projects without copyleft obligations, but you must retain license notices.
Quickstart
pip install advocate
import advocate
response = advocate.get("http://example.com/")
# Or with a session and custom validation:
from advocate import AddrValidator, Session
validator = AddrValidator(hostname_blacklist={"*.internal"})
sess = Session(validator=validator)
response = sess.get("http://example.com/")Verify before relying
- Whether the abandoned status and lack of maintenance since 2020 pose a security risk for new deployments in modern threat landscapes.
- How well the package's SSRF protections hold up against contemporary attack vectors not documented in the fact sheet.
- Compatibility with modern versions of requests and its transitive dependencies beyond what the classifiers indicate.
Package facts
| License | Apache 2 permissive |
| Python support | Not specified |
| Install friction | Low. Pure-Python wheel |
| Runtime dependencies | 7 packagesndg-httpsclientnetifacespyasn1pyopensslrequestssixurllib3 |
| Maintenance | Abandoned 2,222 days since the last release |
| Last repo commit | repository archived |
| First released | |
| Downloads | 320,794 / month, #7,632 on PyPI 30-day window, as of 2026-08-14 |
| Known vulnerabilities | None known OSV.dev, checked 2026-08-14 |
| Classifiers | Development Status :: 4 - BetaIntended Audience :: DevelopersLicense :: OSI Approved :: Apache Software LicenseNatural Language :: EnglishProgramming Language :: PythonProgramming Language :: Python :: 2.7Programming Language :: Python :: 3.6Programming Language :: Python :: 3.7Programming Language :: Python :: 3.8Topic :: Internet :: WWW/HTTPTopic :: Security |
Evidence: advocate-1.0.0-py2.py3-none-any.whl
Tags
Let your AI agent find packages like this
Example. Real query, live index.
You found this page by searching. An agent finds it by wishing: SkillFed indexes 14,416 PyPI packages by what they can do, searchable in plain language.
wish › “ssrf prevention”
- advocateAdvocate wraps the requests library to prevent SSRF attacks by…
- safehttpxWraps httpx.AsyncClient.get() with DNS validation and DNS rebinding…
- requests-hardenedWraps the requests library to enforce security defaults and block…
Give your agent the search over MCP, or paste the wish link into any chat.
More WWW/HTTP packages
urllib3 is an HTTP client library that provides thread-safe connection pooling, SSL/TLS verification, multipart file uploads, request retries, compression support, and proxy handling for Python applications.
Requests is a Python HTTP library that simplifies sending HTTP/1.1 requests with automatic handling of headers, authentication, cookies, and response parsing.
h11 is a pure-Python HTTP/1.1 protocol implementation that handles parsing and serializing HTTP messages without any built-in I/O, letting you integrate it with any network layer you choose.
HTTPX is a fully featured HTTP client library for Python that provides both sync and async APIs, with support for HTTP/1.1 and HTTP/2, plus an integrated command-line client.
Install it if you are building new projects or modernizing existing ones that rely on HTTP.
A minimal low-level HTTP client library that sends HTTP requests with thread-safe and task-safe connection pooling, supporting HTTP/1.1, HTTP/2, proxies, and both sync and async interfaces.
aiohttp is an async HTTP client and server framework built on asyncio, supporting both WebSockets and middleware-based routing for building concurrent web applications.
Install it if you need async HTTP client or server capabilities in asyncio-based applications.
See also requests-hardened · safehttpx · tarsafe · asgi-csrf · requests-futures · allianceauth-blacklist · python3-ldap · cloudscraper · netaddr · requests-ntlm3