Class: RailsAiBridge::Registry::PinningHttpAdapter

Inherits:
Faraday::Adapter::NetHttp
  • Object
show all
Defined in:
lib/rails_ai_bridge/registry/pinning_http_adapter.rb

Overview

Faraday adapter that pins a provider connection to one of the IP addresses already approved by EndpointPolicy, while preserving the original Host header and TLS SNI.

The default Faraday :net_http adapter resolves the URL hostname at connect time, which allows a DNS rebinding attack to bypass the SSRF allowlist. This adapter closes that gap by connecting directly to a policy-validated address and setting Net::HTTP#hostname to the original host so certificate validation and SNI continue to work.

Instance Method Summary collapse

Constructor Details

#initialize(app = nil, addresses:, original_host:, **opts) ⇒ PinningHttpAdapter

Returns a new instance of PinningHttpAdapter.

Parameters:

  • app (#call) (defaults to: nil) —

    the next middleware/adapter in the Faraday stack

  • addresses (Array<String>) —

    policy-approved IP addresses

  • original_host (String) —

    the original hostname from the canonical URI

  • opts (Hash) —

    standard Faraday adapter options



27
28
29
30
31
 
# File 'lib/rails_ai_bridge/registry/pinning_http_adapter.rb', line 27

def initialize(app = nil, addresses:, original_host:, **opts, &)
  @addresses = Array(addresses)
  @original_host = original_host
  super(app, opts, &)
end

Instance Method Details

#net_http_connection(env) ⇒ Net::HTTP

Builds a Net::HTTP connection that connects to the pinned address while presenting the original hostname for SNI and the Host header.

Parameters:

  • env (Faraday::Env)

Returns:

  • (Net::HTTP) 


38
39
40
41
42
 
# File 'lib/rails_ai_bridge/registry/pinning_http_adapter.rb', line 38

def net_http_connection(env)
  super.tap do |http|
    http.ipaddr = @addresses.first
  end
end