Public IPv6 is deliberate
Public IPv6 must match an allocated global-unicast prefix from the bundled corpus and lie outside special-purpose ranges. Membership in 2000::/3 alone does not grant access.
TYPO3 · OUTBOUND REQUEST SECURITY
See what gets through.
Explore a target. Change a policy. Understand the decision.
REQUEST LAB
Test an outbound target
Runs in your browser · no target requests
01 Request target
HTTP / HTTPS02 Policy configuration
Public unicast only. Configuring an endpoint does not grant access to ordinary URL importers.
Always take precedence
One IP or CIDR per line. These apply to every client, including allowed endpoints.
Additional Core host allowlist Optional
Exact hosts only. Empty adds no restriction. This intersects the guard policy; it never grants private access.
POLICY DECISIONSimulation
All candidates must pass
Address classification
Decision trace
In evaluation orderA policy preview is not a connection authorization. The extension must recheck every send, retry and redirect and pin the validated addresses.
ADDRESS INTELLIGENCE
Know the destination
A conservative public profile, with explicit exceptions for selected private endpoints.
| Address range | Classification | Public client | Endpoint exception |
|---|
No matching ranges.
Mapped addresses keep IPv4 rules
::ffff:192.168.1.1 is classified by the embedded IPv4 address. An IPv6 representation cannot bypass IPv4 deny rules.
Special purpose stays special
The public profile blocks special-purpose allocations even where IANA marks them globally reachable. “Routable” does not make an address an appropriate HTTP target.
REPRESENTATIVE TEST CORPUS
Put the model to the test
Expected allow/block outcomes and reason codes, executed against the same engine as the explorer.
“Inspect” loads that case and its policy into the explorer.
| Test case | Expected | Observed reason | Result | Action |
|---|
No cases match this filter.
These are prototype policy checks. They do not verify PHP, TYPO3 integration, cURL, live DNS, redirects, cache isolation or wire behavior.
DESIGN BOUNDARIES
One extension. Explicit trust.
Browser policy simulation for netresearch/typo3_http_guard. Address rules come from the repository’s versioned corpus.
Normalize before deciding
HTTP(S), an exact authority and a valid port. Reject userinfo, fragments, zone IDs, Unicode hosts, numeric shortcuts and ambiguous syntax. A single final DNS dot is normalized.
Deny rules have priority
Operator denies and immutable special-purpose blocks cannot be overridden. The public client only permits ordinary public unicast. No first-match-wins behavior.
Grant a client, not a URL
An internal exception binds a trusted client to an exact scheme, host, port, method set and narrow IP set. The endpoint selector here simulates that trusted binding; a user-selectable string must never grant it in production.
Check the whole answer set
Every usable A and AAAA answer must pass. Missing, invalid or excessive answers fail closed. A grant cannot turn a hostname into a trusted destination.
Transport completes the protection
The extension requires controlled cURL, DNS pinning, isolated transfers and fresh checks for redirects and retries. Those transport guarantees are outside this browser simulation.
Keep the scope intact
The product is netresearch/nr-http-guard, an independent TYPO3 extension. nr-vault and nr-llm are references only. Adapters, migrations and changes to either project are out of scope.
Model notes & sources
Address classifications are generated from Resources/Private/HttpGuard/data/security-corpus/address-rules.json in this repository, including allocated IPv6 prefixes. Rule IDs in this explorer describe the simulation; they are not the PHP exception reason codes.
Project documentation ↗IANA IPv4 special-purpose registry ↗IANA IPv6 special-purpose registry ↗OWASP SSRF prevention ↗
Prototype simplifications: one simulated endpoint, optional exact-host Core allowlist, no profile expiry or ownership workflow, no redirects or transport options. CONNECT and TRACE are rejected. Unknown environment-specific routing and custom NAT64 prefixes require operator controls. All inputs remain in memory; exporting or copying is explicit. No analytics, target fetches or DNS requests.