PHPackages                             bahdan/symfony-safe-http-client - PHPackages - PHPackages  [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register)

1. [Directory](/)
2. /
3. bahdan/symfony-safe-http-client

ActiveLibrary

bahdan/symfony-safe-http-client
===============================

SSRF-protected HTTP Client wrapper for Symfony HttpClient with DNS resolution pinning and subnet validation

v1.1.1(today)035↑2642.9%MITPHPPHP >=8.3CI passing

Since Aug 24Pushed todayCompare

[ Source](https://github.com/bahdanhal/symfony-safe-http-client)[ Packagist](https://packagist.org/packages/bahdan/symfony-safe-http-client)[ RSS](/packages/bahdan-symfony-safe-http-client/feed)WikiDiscussions main Synced today

READMEChangelogDependencies (3)Versions (6)Used By (0)

Symfony Safe HTTP Client
========================

[](#symfony-safe-http-client)

An SSRF-safe HTTP client wrapper on top of Symfony `HttpClient` with DNS resolution pinning and subnet validation.

[Packagist](https://packagist.org/packages/bahdan/symfony-safe-http-client) · [GitHub](https://github.com/bahdanhal/symfony-safe-http-client)

Features
--------

[](#features)

- **SSRF Defense**: Validates URLs against private IP ranges (RFC 1918, RFC 4193), link-local addresses, and cloud instance metadata (`169.254.169.254`).
- **DNS Resolution Pinning**: Resolves hostnames before request dispatch and pins the IP to prevent DNS rebinding attacks.
- **Concurrent DNS**: Resolves unique batch hostnames concurrently through Amp instead of serial native DNS calls.
- **Safety Limits**: Configurable body size limits, redirect limits, and request timeouts.
- **Port Allowlist**: Allows only HTTP ports 80 and 443 by default to prevent cross-protocol SSRF.
- **Batch Requests**: Concurrently fetch and safely resolve multiple URLs.
- **DI-Friendly Contract**: Type-hint `SafeHttpFetcherInterface` in application services.

Installation
------------

[](#installation)

```
composer require bahdan/symfony-safe-http-client
```

Usage
-----

[](#usage)

```
use Bahdan\SafeHttpClient\SafeHttpFetcher;
use Bahdan\SafeHttpClient\UrlGuard;
use Symfony\Component\HttpClient\HttpClient;

$guard = new UrlGuard();
$fetcher = new SafeHttpFetcher(HttpClient::create(), $guard);

$result = $fetcher->fetch('https://example.com');
echo $result['body'];
```

Implement `DnsResolverInterface` and pass it to `UrlGuard` to use a custom resolver while retaining subnet validation and connection pinning.

Applications that intentionally fetch from another HTTP port can opt in explicitly:

```
$guard = new UrlGuard(allowedPorts: [80, 443, 8080, 8443]);
```

How DNS rebinding protection works
----------------------------------

[](#how-dns-rebinding-protection-works)

The guard resolves every hostname before a request, rejects the request if any returned address belongs to a private, loopback, link-local, reserved, multicast, documentation, or cloud metadata range, and returns one validated public address. `SafeHttpFetcher` passes that address through Symfony HttpClient's `resolve` option. The socket therefore connects to the exact address that was validated while the original hostname remains in the URL for TLS SNI and certificate verification. Redirect targets repeat the full validation and pinning process.

Canonical IPv4 and IPv6 literals are checked directly. Ambiguous legacy numeric forms such as dotted octal and hexadecimal addresses are rejected instead of being delegated to platform-dependent DNS parsing.

Symfony dependency injection
----------------------------

[](#symfony-dependency-injection)

The package is framework-agnostic, so it does not force a bundle into applications that only need the library. Register it with standard Symfony service configuration:

```
# config/services.yaml
services:
  Bahdan\SafeHttpClient\UrlGuard: ~

  Bahdan\SafeHttpClient\SafeHttpFetcher:
    arguments:
      $httpClient: '@http_client'

  Bahdan\SafeHttpClient\SafeHttpFetcherInterface:
    alias: Bahdan\SafeHttpClient\SafeHttpFetcher
```

Application services can now depend on `Bahdan\SafeHttpClient\SafeHttpFetcherInterface` and replace the implementation in tests.

License
-------

[](#license)

MIT

###  Health Score

44

—

FairBetter than 90% of packages

Maintenance100

Actively maintained with recent releases

Popularity11

Limited adoption so far

Community2

Small or concentrated contributor base

Maturity52

Maturing project, gaining track record

How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window.

**Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores.

**Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement.

**Maturity (30%)** — Project age, version count, PHP version support, and release stability.

###  Release Activity

Cadence

Every ~0 days

Total

5

Last Release

0d ago

### Community

Maintainers

![](https://avatars.githubusercontent.com/u/3841889?v=4)[bhal](/maintainers/bhal)[@Bhal](https://github.com/Bhal)

###  Code Quality

TestsPHPUnit

### Embed Badge

![Health badge](/badges/bahdan-symfony-safe-http-client/health.svg)

```
[![Health](https://phpackages.com/badges/bahdan-symfony-safe-http-client/health.svg)](https://phpackages.com/packages/bahdan-symfony-safe-http-client)
```

###  Alternatives

[craftcms/cms

Craft CMS

3.6k3.7M3.5k](/packages/craftcms-cms)

PHPackages © 2026

[Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)