--- title: HTTP Client SSRF Mitigation with InetAddressFilter in... description: Spring Boot 4.1 introduces InetAddressFilter, a first-class API for mitigating Server-Side Request Forgery (SSRF) in HTTP clients. Unlike hostname or URL... canonical: https://daily.dev/posts/http-client-ssrf-mitigation-with-inetaddressfilter-in-spring-boot-eiy9td6fz twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: HTTP Client SSRF Mitigation with InetAddressFilter in Spring Boot | daily.dev og:description: Spring Boot 4.1 introduces InetAddressFilter, a first-class API for mitigating Server-Side Request Forgery (SSRF) in HTTP clients. Unlike hostname or URL... og:url: https://daily.dev/posts/http-client-ssrf-mitigation-with-inetaddressfilter-in-spring-boot-eiy9td6fz og:image: https://api.daily.dev/og/posts/Eiy9Td6FZ.png og:image:alt: HTTP Client SSRF Mitigation with InetAddressFilter in Spring Boot og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # HTTP Client SSRF Mitigation with InetAddressFilter in Spring Boot **[Baeldung](https://daily.dev/sources/baeldung)** · 5 min read · 2 upvotes · 0 comments ## Summary Spring Boot 4.1 introduces InetAddressFilter, a first-class API for mitigating Server-Side Request Forgery (SSRF) in HTTP clients. Unlike hostname or URL validation, the filter checks the resolved IP address after DNS resolution, letting developers allow only external addresses or block internal ranges using composable operators like and(), or(), and negate(). The filter can be applied globally via a Spring bean affecting all auto-configured clients (RestClient, WebClient, RestTemplate), or per-client through HttpClientSettings for fine-grained control. A rejected request throws FilteredHostException before any connection is established. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How do I prevent SSRF attacks in a Spring Boot RestClient or WebClient? Spring Boot 4.1 adds the InetAddressFilter interface, which checks the resolved IP address of an outbound HTTP request after DNS resolution rather than validating the hostname or URL. You can apply built-in filters like InetAddressFilter.externalAddresses() globally as a bean, or per-client via HttpClientSettings.withInetAddressFilter(), so requests to loopback or internal addresses throw a FilteredHostException before a connection opens. _daily.dev surfaces practical security patterns like SSRF mitigation as new framework releases land._ ### What Spring Boot version added the InetAddressFilter class for SSRF protection? InetAddressFilter was introduced as first-class SSRF mitigation support in Spring Boot 4.1.0, requiring the spring-boot-starter-restclient dependency. Before this, developers had to write custom ClientHttpRequestInterceptor implementations or rely on network-level firewalls to block requests to internal addresses, cloud metadata endpoints, or loopback ranges. _track new Spring Boot security capabilities like this on daily.dev before they hit production._ ### Can I apply different SSRF filtering rules to different HTTP clients in the same Spring Boot application? Yes, an InetAddressFilter can be scoped to an individual client by configuring HttpClientSettings with withInetAddressFilter() and passing it into a ClientHttpRequestFactoryBuilder when building that specific RestClient, instead of registering a global InetAddressFilter bean. This lets one client restrict traffic to external addresses while another uses a custom allowlist for trusted internal services. _developers weighing global versus per-client security policies can follow Spring Boot updates on daily.dev._ ## Similar posts on daily.dev - [How to Prevent SSRF Attacks in PHP: Nette Http 3.4.0 – Nette Blog](https://daily.dev/posts/how-to-prevent-ssrf-attacks-in-php-nette-http-3-4-0-nette-blog-vyqjazxxc) · Nette · 4 upvotes · 0 comments - [In Spring for Apache Kafka, SSRF via DNS resolution triggered by untrusted java.net types in header mapper default trusted packages](https://daily.dev/posts/in-spring-for-apache-kafka-ssrf-via-dns-resolution-triggered-by-untrusted-java-net-types-in-header--mk0ygsrfq) · Spring · 1 upvotes · 0 comments - [Preventing SSRF in Laravel: Why Blocking Private IPs Fails](https://daily.dev/posts/preventing-ssrf-in-laravel-why-blocking-private-ips-fails-xpdzp3fxe) · FREEK.DEV · 0 upvotes · 0 comments - [GitHub - scoville/req\_ssrf: SSRF protection for Req](https://daily.dev/posts/github---scoville-req-ssrf-ssrf-protection-for-req-4awzo12ju) · ElixirStatus · 0 upvotes · 0 comments - [CVE-2026-25765 \(faraday\): Faraday affected by SSRF via protocol-relative URL host override in build\_exclusive\_url](https://daily.dev/posts/cve-2026-25765-faraday-faraday-affected-by-ssrf-via-protocol-relative-url-host-override-in-build--axr8zcqbx) · RUBYLAND · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#java](https://daily.dev/tags/java), [#spring-boot](https://daily.dev/tags/spring-boot), [#appsec](https://daily.dev/tags/appsec) [View this post on daily.dev](https://daily.dev/posts/http-client-ssrf-mitigation-with-inetaddressfilter-in-spring-boot-eiy9td6fz) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"HTTP Client SSRF Mitigation with InetAddressFilter in Spring Boot","url":"https://daily.dev/posts/http-client-ssrf-mitigation-with-inetaddressfilter-in-spring-boot-eiy9td6fz","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/http-client-ssrf-mitigation-with-inetaddressfilter-in-spring-boot-eiy9td6fz"},"datePublished":"2026-08-22T23:46:06.390Z","dateModified":"2026-09-14T08:46:14.722Z","description":"Spring Boot 4.1 introduces InetAddressFilter, a first-class API for mitigating Server-Side Request Forgery (SSRF) in HTTP clients. Unlike hostname or URL...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/9fe6a7e1fed5dab6e32774e8bd9483c7?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/9fe6a7e1fed5dab6e32774e8bd9483c7?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Baeldung","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Baeldung","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/52cccfb454d946c4b7dfa5e816f9e576","url":"https://daily.dev/sources/baeldung"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/http-client-ssrf-mitigation-with-inetaddressfilter-in-spring-boot-eiy9td6fz","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":2},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,java,spring-boot,appsec","timeRequired":"PT5M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Baeldung","item":"https://daily.dev/sources/baeldung"},{"@type":"ListItem","position":3,"name":"HTTP Client SSRF Mitigation with InetAddressFilter in Spring Boot"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/http-client-ssrf-mitigation-with-inetaddressfilter-in-spring-boot-eiy9td6fz#faq","mainEntity":[{"@type":"Question","name":"How do I prevent SSRF attacks in a Spring Boot RestClient or WebClient?","acceptedAnswer":{"@type":"Answer","text":"Spring Boot 4.1 adds the InetAddressFilter interface, which checks the resolved IP address of an outbound HTTP request after DNS resolution rather than validating the hostname or URL. You can apply built-in filters like InetAddressFilter.externalAddresses() globally as a bean, or per-client via HttpClientSettings.withInetAddressFilter(), so requests to loopback or internal addresses throw a FilteredHostException before a connection opens. daily.dev surfaces practical security patterns like SSRF mitigation as new framework releases land."}},{"@type":"Question","name":"What Spring Boot version added the InetAddressFilter class for SSRF protection?","acceptedAnswer":{"@type":"Answer","text":"InetAddressFilter was introduced as first-class SSRF mitigation support in Spring Boot 4.1.0, requiring the spring-boot-starter-restclient dependency. Before this, developers had to write custom ClientHttpRequestInterceptor implementations or rely on network-level firewalls to block requests to internal addresses, cloud metadata endpoints, or loopback ranges. track new Spring Boot security capabilities like this on daily.dev before they hit production."}},{"@type":"Question","name":"Can I apply different SSRF filtering rules to different HTTP clients in the same Spring Boot application?","acceptedAnswer":{"@type":"Answer","text":"Yes, an InetAddressFilter can be scoped to an individual client by configuring HttpClientSettings with withInetAddressFilter() and passing it into a ClientHttpRequestFactoryBuilder when building that specific RestClient, instead of registering a global InetAddressFilter bean. This lets one client restrict traffic to external addresses while another uses a custom allowlist for trusted internal services. developers weighing global versus per-client security policies can follow Spring Boot updates on daily.dev."}}]} ```