advocate

What it is and what it does

Advocate is a wrapper around the requests library designed to prevent Server-Side Request Forgery (SSRF) attacks by validating HTTP request destinations before they are made. It intercepts connection attempts and checks them against configurable rules to block access to internal addresses, private IP ranges, and other potentially dangerous targets. The package handles DNS rebinding attacks by performing address validation at the socket level, ensuring that the address checked matches the one actually used for connection.

The package is most useful when your application makes HTTP requests on behalf of untrusted users or third parties—scenarios where an attacker might try to manipulate URLs to access internal services, cloud metadata endpoints, or other restricted resources. Advocate aims to be a drop-in replacement for requests in many cases, offering both simple function-level wrappers and a subclassed Session with sensible defaults. It also provides an AddrValidator class for fine-grained control over which addresses are allowed or blocked.

Use it for:

• Proxy or webhook services that fetch URLs submitted by users, preventing attackers from targeting internal infrastructure.
• Web scrapers or link-checking tools that process user-supplied URLs without exposing internal network resources.
• API gateways or content aggregators that need to safely fetch remote resources while protecting backend systems.
• Applications handling file downloads or image processing from user-provided URLs in multi-tenant environments.
• Testing frameworks or security scanners that need to make controlled HTTP requests without accidentally hitting internal services.

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

Advocate wraps the requests library to prevent SSRF attacks by validating HTTP request destinations before connection, blocking access to internal addresses and handling DNS rebinding attacks.

No. The project is archived and abandoned since 2023, with the last release in 2020. While the code is permissively licensed and has low install friction, the lack of maintenance means it will not receive security updates, bug fixes, or compatibility patches for modern Python and dependency versions. For new projects, consider actively maintained SSRF prevention libraries or implement request validation at the network/proxy layer instead.

Install

advocate on PyPI

pip install advocate

uv add advocate

poetry add advocate

Installing advocate

Before you install

Low install friction with a pure-Python wheel, but the project is archived and abandoned as of 2023-08-31, with no releases since 2020-07-14. The seven runtime dependencies (ndg-httpsclient, netifaces, pyasn1, pyopenssl, requests, six, urllib3) are stable but the package itself receives no maintenance.

License in practice

Licensed under Apache 2 (permissive), so you can use it freely in commercial and open-source projects without copyleft obligations, but you must retain license notices.

Quickstart

pip install advocate

import advocate
response = advocate.get("http://example.com/")

# Or with a session and custom validation:
from advocate import AddrValidator, Session
validator = AddrValidator(hostname_blacklist={"*.internal"})
sess = Session(validator=validator)
response = sess.get("http://example.com/")

Officially supported on CPython 2.7+, CPython 3.4+, and PyPy 2; IPv6 support is incomplete and disabled by default.

Verify before relying

• Whether the abandoned status and lack of maintenance since 2020 pose a security risk for new deployments in modern threat landscapes.
• How well the package's SSRF protections hold up against contemporary attack vectors not documented in the fact sheet.
• Compatibility with modern versions of requests and its transitive dependencies beyond what the classifiers indicate.

Package facts

Evidence: advocate-1.0.0-py2.py3-none-any.whl

Keywords: http, requests, security, ssrf, proxy, rebinding, advocate

Tags

More WWW/HTTP packages