FlowDrop Workflow Specification 1.0-draft

An outbound URL is checked before the request, and the check is pinned to it

Validating a name and then dialling the name is not a check: a hostile resolver answers publicly for the check and privately for the request.

The rule

Normative: this is the rule
  1. Before a node makes a request to a URL derived from workflow input, the URL is validated: only http and https are allowed, the host is resolved (over both IPv4 and IPv6), and any address in a private or reserved range is refused.
  2. A refusal is a node configuration error, which takes the error edge rather than failing the run.
  3. The validated address is what the request must then be made to: the connection is pinned to the address that was checked, honouring an explicit port.
  4. Every node that dials a caller-supplied URL performs this check; a second implementation of it is a second thing to forget to fix.
Rule identifiers are permanent and are never renumbered. Each implementation publishes its own standing against these rules; this specification does not.spec 1.0-draft · NET-1 · changed in spec 1.0