Skip to content
sproutboat
Esc
↑↓navigate↵open⌘Jpreview
On this page

Outbound fetch

fetch() reaches any public address, and never a private one.

Usage

fetch() needs no configuration.

const res = fetch("https://api.stripe.com/v1/charges", {
  method: "POST",
  headers: { authorization: "Bearer " + env.STRIPE_KEY },
  body,
});

It returns the response directly, and the whole body is read into memory, up to 32 MiB by default. Redirects are returned to the handler, not followed.

Private addresses

fetch() refuses private and reserved addresses: loopback, private networks (RFC 1918), link-local and the cloud metadata endpoint 169.254.169.254, CGNAT, multicast, and their IPv6 equivalents, including IPv4-mapped and NAT64 forms. The check runs on the address a name resolves to, at connect time, so a public name pointing at a private address is refused too.

fetch() refused: db.internal resolves to 10.0.0.7, a private or reserved address (10.0.0.0/8). An operator can allow it with SB_EGRESS_ALLOW=10.0.0.7

Whoever runs the server can let specific addresses through with SB_EGRESS_ALLOW, either * or a comma-separated list of exact addresses. On a self-hosted platform, add it to /etc/sproutboat/egress.env and restart sproutboat-egress; for a standalone build, set it in the binary’s environment. Handler code cannot change it.

Was this page helpful?