Spring Boot 4.1 introduces InetAddressFilter, a first-class API for mitigating Server-Side Request Forgery (SSRF) in HTTP clients. Unlike hostname or URL validation, the filter checks the resolved IP address after DNS resolution, letting developers allow only external addresses or block internal ranges using composable operators like and(), or(), and negate(). The filter can be applied globally via a Spring bean affecting all auto-configured clients (RestClient, WebClient, RestTemplate), or per-client through HttpClientSettings for fine-grained control. A rejected request throws FilteredHostException before any connection is established.
Table of contents
1. Introduction2. Understanding SSRF in the Context of HTTP Clients3. Maven Dependency4. Introducing InetAddressFilter5. Applying the Filter Globally6. Applying the Filter Per-Client7. Test8. ConclusionQuestions this post answers
How do I prevent SSRF attacks in a Spring Boot RestClient or WebClient?
Spring Boot 4.1 adds a built-in InetAddressFilter interface that validates the resolved IP address of an outbound HTTP request before a connection is established. Declaring an InetAddressFilter bean, such as InetAddressFilter.externalAddresses(), automatically applies to all auto-configured RestClient, WebClient, and RestTemplate instances, rejecting requests to loopback or internal addresses with a FilteredHostException. daily.dev helps backend developers track new Spring Boot security features like SSRF filtering as they ship.
What is the difference between InetAddressFilter.externalAddresses() and internalAddresses() in Spring Boot?
InetAddressFilter.externalAddresses() allows only publicly routable IP addresses for outbound HTTP requests, while internalAddresses() targets special-purpose network ranges such as loopback or private addresses so they can be blocked. Both are built-in filters that can be combined with and(), or(), and negate() operators to build custom allowlists or blocklists, such as InetAddressFilter.of("192.168.0.0/16").andNot("192.168.1.100"). Developers hardening outbound network policy can follow Spring Boot security changes on daily.dev.
Can I apply different SSRF protection rules to different HTTP clients in the same Spring Boot application?
Yes, an InetAddressFilter can be attached to an individual client rather than applied globally by configuring HttpClientSettings.defaults().withInetAddressFilter() and building a ClientHttpRequestFactory with ClientHttpRequestFactoryBuilder.jdk(). This lets one RestClient restrict calls to public addresses for third-party APIs while another client uses a separate allowlist for trusted internal services. daily.dev keeps developers building fine-grained security policies up to date on Spring Boot changes.