quarkus-safe-fetch

Outbound HTTP for Quarkus with an SSRF guard, timeouts, response-size and redirect limits. Usable alone: it knows nothing about ActivityPub, AT Protocol or any other protocol.

Minimum supported Quarkus: 3.40 (LTS). Status: experimental, version 0.1.

<dependency>
  <groupId>org.sitenetsoft.quarkus</groupId>
  <artifactId>quarkus-safe-fetch</artifactId>
  <version>0.1.0-SNAPSHOT</version>
</dependency>

See quarkus-skill.md for patterns and pitfalls, and docs/ for the Antora guide.

API

Both SafeFetchClient (blocking) and ReactiveSafeFetchClient (Uni) expose:

Method	Purpose
send(method, uri, body, options)	Any HTTP method; body may be null for no body
get(uri[, options])	send("GET", uri, null, options)
post(uri, body, options)	send("POST", uri, body, options)

Redirects are followed only for GET and HEAD; for other methods the 3xx response is returned as-is. Headers passed in FetchOptions are sent on same-host redirect hops only: once a redirect leads to another host (compared case-insensitively) they are dropped for that hop and every later one.

FetchResponse holds:

Component	Purpose
uri()	The URL the response came from: the last hop after redirects, else the request URL
status()	HTTP status; non-2xx statuses are returned, not thrown
headers(), header(name)	Response headers, case-insensitive
body(), bodyAsString()	The body, bounded by max-response-size

Configuration

Property	Default	Purpose
quarkus.safe-fetch.https-only	true	Refuse plain http URLs
quarkus.safe-fetch.allow-private-addresses	false	Allow loopback, link-local and private ranges (tests only)
quarkus.safe-fetch.timeout	10s	Timeout for a whole fetch including redirects
quarkus.safe-fetch.max-response-size	1M	Largest accepted body
quarkus.safe-fetch.max-redirects	3	Redirects followed before failing
quarkus.safe-fetch.user-agent	quarkus-safe-fetch	User-Agent header

Building

JAVA_HOME=/path/to/jdk21 mvn -T 8 install

CI builds on the current LTS and the latest Quarkus release, plus a native-image job.