safehttpx

What it is and what it does

safehttpx is an async HTTP client wrapper that adds SSRF attack protection on top of httpx. It validates URLs against public DNS before making requests and implements defenses against DNS rebinding attacks, which can trick applications into accessing internal services. The library rejects requests to private IP ranges (like 127.0.0.1) by default, but allows whitelisting of specific domains when needed—for instance, if your infrastructure uses DNS splitting to serve internal and external addresses differently.

The package is a thin, low-friction layer: it depends only on httpx and comes as a pure Python wheel. It was created following a security audit of Gradio and is now used in production there. The async-only API means you must structure code around asyncio, either by using it in an event-loop-aware environment (Jupyter, IPython) or by wrapping calls in asyncio.run() in standard scripts.

Use it for:

• Protect web services that fetch user-supplied URLs (e.g., link previews, webhook handlers) from SSRF attacks.
• Prevent attackers from using your server to scan internal networks or access cloud metadata services.
• Safely make HTTP requests in multi-tenant or untrusted-input scenarios where URL validation is critical.
• Block DNS rebinding attacks that attempt to redirect public domains to internal IP addresses mid-request.
• Whitelist trusted internal domains while still validating external URLs in hybrid network architectures.

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

Wraps httpx.AsyncClient.get() with DNS validation and DNS rebinding protections to prevent Server Side Request Forgery (SSRF) attacks.

Yes, if you need SSRF protection and are already using async HTTP in Python >3.9. The library is lightweight, permissively licensed, and battle-tested in Gradio. The aging maintenance status (no release in 294 days) is a minor concern but not a blocker if the current version meets your needs; no known vulnerabilities are recorded. Install it if SSRF is a real threat in your application; skip it if you are not accepting untrusted URLs or are not using async code.

Install

safehttpx on PyPI

pip install safehttpx

uv add safehttpx

poetry add safehttpx

Installing safehttpx

Before you install

Low friction: pure Python wheel with a single runtime dependency (httpx). Maintenance status is aging—last commit was 2025-10-24 and the project has not released a new version in 294 days, though the repository remains active and unarchived.

License in practice

MIT license (permissive). You may use, modify, and distribute this package freely, including in commercial applications, provided you retain the license notice.

Quickstart

import asyncio
import safehttpx as sh

await sh.get("https://huggingface.co")
# or in a script:
asyncio.run(sh.get("https://huggingface.co"))

Requires Python >3.9 and an asyncio event loop; the get() method is async-only and will reject requests to private/reserved IP ranges by default.

Verify before relying

• Whether Google DNS is always reachable or if there is a fallback mechanism for DNS resolution.
• Performance overhead of DNS validation on each request compared to standard httpx.
• Whether the whitelist feature supports wildcards or only exact domain matches.
• Specific DNS rebinding attack scenarios the library defends against beyond basic validation.

Package facts

Evidence: safehttpx-0.1.7-py3-none-any.whl

Tags

More Security packages