Harden Outbound URL Validation

The problem

Inconsistent outbound URL validation leads to Server-Side Request Forgery (SSRF) vulnerabilities and unpredictable application behavior. Developers often struggle to align DNS resolution, host normalization, and redirect policies across fragmented codebases.

What it does

• Identifies every component involved in the outbound request lifecycle, from parsing to dispatch.
• Patches URL parsers to handle host normalization and private/reserved IP classification correctly.
• Enforces strict trust boundaries by moving validation before irreversible side effects or mutations.
• Implements deterministic local fixtures and loopback endpoints for reliable regression testing.
• Ensures retries, timeouts, and cleanup logic are bound to the specific transaction state.

Why this beats prompting it yourself

Generic prompts often suggest broad regex or simple blacklists that bypass edge cases like DNS rebinding or malformed userinfo. This skill systematically maps state ownership and authority boundaries to ensure security policies are actually enforceable in your specific architecture.

Use cases

• Hardening a proxy service against DNS rebinding and internal IP access.
• Refactoring legacy request handlers to support unified SSRF-resistant validation.
• Adding redacted observability and deterministic tests to outbound network modules.
• Synchronizing redirect and proxy policies across multiple internal services.

Known limitations

This skill operates strictly on repository files and local fixtures. It cannot contact production services, read live secrets, or mutate deployed infrastructure.