no-ssrf · can your SSRF filter catch these?

Your server fetches a URL a user typed: a webhook, a link preview, an image import. These are the URLs that turn that feature into a way into your own network. Paste one, or read the gallery below.

URL to test

The gallery

URL (click one to test it)	Should be			no-ssrf

Use it

import { checkUrl } from "@qaweem321/no-ssrf";        // anywhere: Node, Bun, Deno, edge, browser
import { safeRequest } from "@qaweem321/no-ssrf/node";  // Node: checks every DNS answer and redirect

const verdict = checkUrl(userUrl);
if (!verdict.ok) return { error: verdict.reason };

const res = await safeRequest(verdict.url, { method: "POST", body, timeoutMs: 5000 });

Checking the URL is half the job: a domain can resolve to a private address, or switch to one between your check and the request. safeRequest checks the address it actually connects to. Source, docs and tests on GitHub.