--- title: "HTTP Client SSRF Mitigation with InetAddressFilter in Spring Boot" url: https://daily.dev/posts/http-client-ssrf-mitigation-with-inetaddressfilter-in-spring-boot-eiy9td6fz source_url: https://feeds.feedblitz.com/~/968126762/0/baeldung~HTTP-Client-SSRF-Mitigation-with-InetAddressFilter-in-Spring-Boot type: article source: "Baeldung" published: 2026-08-22T23:46:06.390Z updated: 2026-08-22T23:46:34.826Z tags: ["security", "java", "spring-boot", "appsec"] reading_time: 5 upvotes: 2 comments: 0 language: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # HTTP Client SSRF Mitigation with InetAddressFilter in Spring Boot **[Baeldung](https://daily.dev/sources/baeldung)** · 5 min read · 2 upvotes · 0 comments ## Summary Spring Boot 4.1 introduces InetAddressFilter, a first-class API for mitigating Server-Side Request Forgery (SSRF) in HTTP clients. Unlike hostname or URL validation, the filter checks the resolved IP address after DNS resolution, letting developers allow only external addresses or block internal ranges using composable operators like and(), or(), and negate(). The filter can be applied globally via a Spring bean affecting all auto-configured clients (RestClient, WebClient, RestTemplate), or per-client through HttpClientSettings for fine-grained control. A rejected request throws FilteredHostException before any connection is established. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How do I prevent SSRF attacks in a Spring Boot RestClient or WebClient? Spring Boot 4.1 adds a built-in InetAddressFilter interface that validates the resolved IP address of an outbound HTTP request before a connection is established. Declaring an InetAddressFilter bean, such as InetAddressFilter.externalAddresses(), automatically applies to all auto-configured RestClient, WebClient, and RestTemplate instances, rejecting requests to loopback or internal addresses with a FilteredHostException. _daily.dev helps backend developers track new Spring Boot security features like SSRF filtering as they ship._ ### What is the difference between InetAddressFilter.externalAddresses() and internalAddresses() in Spring Boot? InetAddressFilter.externalAddresses() allows only publicly routable IP addresses for outbound HTTP requests, while internalAddresses() targets special-purpose network ranges such as loopback or private addresses so they can be blocked. Both are built-in filters that can be combined with and(), or(), and negate() operators to build custom allowlists or blocklists, such as InetAddressFilter.of("192.168.0.0/16").andNot("192.168.1.100"). _Developers hardening outbound network policy can follow Spring Boot security changes on daily.dev._ ### Can I apply different SSRF protection rules to different HTTP clients in the same Spring Boot application? Yes, an InetAddressFilter can be attached to an individual client rather than applied globally by configuring HttpClientSettings.defaults().withInetAddressFilter() and building a ClientHttpRequestFactory with ClientHttpRequestFactoryBuilder.jdk(). This lets one RestClient restrict calls to public addresses for third-party APIs while another client uses a separate allowlist for trusted internal services. _daily.dev keeps developers building fine-grained security policies up to date on Spring Boot changes._ ## Similar posts on daily.dev - [How to Prevent SSRF Attacks in PHP: Nette Http 3.4.0 – Nette Blog](https://daily.dev/posts/how-to-prevent-ssrf-attacks-in-php-nette-http-3-4-0-nette-blog-vyqjazxxc) · Nette · 4 upvotes · 0 comments - [In Spring for Apache Kafka, SSRF via DNS resolution triggered by untrusted java.net types in header mapper default trusted packages](https://daily.dev/posts/in-spring-for-apache-kafka-ssrf-via-dns-resolution-triggered-by-untrusted-java-net-types-in-header--mk0ygsrfq) · Spring · 1 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#java](https://daily.dev/tags/java), [#spring-boot](https://daily.dev/tags/spring-boot), [#appsec](https://daily.dev/tags/appsec) [View this post on daily.dev](https://daily.dev/posts/http-client-ssrf-mitigation-with-inetaddressfilter-in-spring-boot-eiy9td6fz)