---
id: NET-1
family: RT-NET
level: core
profiles: [runtime]
posture: normative-target
added: "1.0"
changed: "1.0"
source: https://flowdrop.io/spec/rules/rt-net/net-1
specification: FlowDrop Workflow Specification 1.0-draft
licence: CC BY 4.0
---

# NET-1 — An outbound URL is checked before the request, and the check is pinned to it

*RT-NET (Part II) · level: core · profiles: runtime · added in 1.0*

Validating a name and then dialling the name is not a check: a hostile resolver answers publicly for the check and privately for the request.

## The rule

> **Normative.** This is the rule.
>
> 1. Before a node makes a request to a URL derived from workflow input, the URL is validated: only `http` and `https` are allowed, the host is resolved (over both IPv4 and IPv6), and any address in a private or reserved range is refused.
>
> 2. A refusal is a node configuration error, which takes the error edge rather than failing the run.
>
> 3. The validated address is what the request must then be made to: the connection is pinned to the address that was checked, honouring an explicit port.
>
> 4. Every node that dials a caller-supplied URL performs this check; a second implementation of it is a second thing to forget to fix.

## Related rules

- Names: NET-2, NET-3
- Referenced by: NET-2, NET-3

---

Rule identifiers are permanent and are never renumbered. This specification carries
no implementation status: each implementation publishes its own standing against
these rules. Licensed CC BY 4.0.