Class WebEgressPolicy
The one gate every server-side web fetch passes through. Tools run on the host that serves remote callers, so an unchecked URL is a route into that host's own network; this policy decides what a fetch may reach and pins how it connects.
Two modes. PublicWeb (the default) requires no configuration: any public web destination is reachable, while every address in the host's own world (loopback, RFC1918, link-local and its metadata endpoints, CGNAT, ULA, multicast, reserved) is unreachable by construction. AllowedHostsOnly additionally requires the destination host to be explicitly listed.
Independent of mode, PrivateAllowedHosts names the intranet endpoints an administrator deliberately opens; only those may resolve to non-public addresses.
Connections are DNS-PINNED: names resolve once per hop, every resolved address is validated, and the socket connects to an address from that validated set, so a name cannot re-resolve to something private between check and connect. Redirects are followed manually and each hop re-enters the full validation.
public sealed class WebEgressPolicy- Inheritance
-
WebEgressPolicy
- Inherited Members
Properties
- AllowedHosts
Hosts reachable under AllowedHostsOnly, compared case-insensitively against the URL host, exactly.
- MaxRedirects
Most redirect hops one fetch may follow. Each hop revalidates.
- MaxResponseBytes
Response cap in bytes, applied to the DECOMPRESSED stream.
- PrivateAllowedHosts
Hosts that MAY resolve to non-public addresses, in either mode: the administrator's deliberate intranet exceptions. Everything else must resolve public.
- Resolve
Name resolution seam. Tests replace it to prove pinning and rebinding behavior without sockets; production resolves through DNS.
- Timeout
Wall-clock budget for the whole fetch, redirects included.
- UserAgent
User-Agent presented by gate-driven fetches.
Methods
- IsPublicAddress(IPAddress)
Whether the address belongs to the public internet. Everything a server-side fetch could use to reach its host's own world is refused: loopback, unspecified, RFC1918, link-local (cloud metadata lives there), CGNAT, documentation and benchmarking ranges, multicast, broadcast, reserved, and their IPv6 equivalents including ULA; IPv4-mapped IPv6 is judged as the mapped IPv4.
- ValidateRequest(Uri)
Validates one request URL and, when allowed, returns the pinned address set its connection must use. This is the WHOLE decision: scheme, credentials, mode and host lists, then the resolved addresses of any host that is not deliberately private-listed.