How Spring Boot 4.1’s New InetAddressFilter Mitigates SSRF Attacks

1. Introduction

SSRF (Server‑Side Request Forgery) is a high‑risk vulnerability that lets an attacker force a server to access internal or sensitive resources, potentially leaking data. Spring Boot 4.1 introduces the functional interface InetAddressFilter, which allows HTTP clients to filter requests by IP address, such as permitting only public addresses or blocking specific internal subnets.

2. Example endpoint

private final RestClient restClient;

@GetMapping("/fetch")
public String fetch(String url) {
    return restClient.get()
        .uri(url)
        .retrieve()
        .body(String.class);
}

The endpoint forwards the URL supplied by the caller to RestClient so that users can fetch content from arbitrary public URLs.

Legitimate request

curl --location http://127.0.0.1/fetch?url=https://api.pack.com

Malicious request (SSRF)

curl --location http://127.0.0.1/fetch?url=http://192.168.10.100/users

Such a request could expose internal management APIs or databases. Prior to Spring Boot 4.1, developers mitigated SSRF by implementing a custom ClientHttpRequestInterceptor. Starting with 4.1.0, the built‑in InetAddressFilter provides first‑class support.

2.1 Prepare environment

Add the RestClient starter dependency:

<dependency>
  <groupId>org.springframework.boot</groupId>
  <artifactId>spring-boot-starter-restclient</artifactId>
</dependency>

2.2 InetAddressFilter overview

InetAddressFilter

is a functional interface that can restrict HTTP calls, for example allowing only local addresses or blocking specific IPs. It provides static factory methods and combinators such as and(), or(), andNot() and negate() for building complex rules.

InetAddressFilter.of("192.168.0.0/24").andNot("192.168.0.1");
InetAddressFilter.externalAddresses().or(InetAddressFilter.of("10.20.0.0"));

2.3 Using InetAddressFilter

The simplest approach is to declare an InetAddressFilter bean; Spring Boot will automatically apply it to all auto‑configured HTTP client builders (RestClient, WebClient, RestTemplate, etc.).

@Configuration(proxyBeanMethods = false)
public class HttpClientConfig {
    @Bean
    InetAddressFilter httpClientInetAddressFilter() {
        return InetAddressFilter
            .of("192.168.1.0/24")
            .andNot("192.168.1.1", "192.168.1.10");
    }
}

With the bean in place, the following RestClient bean needs no extra code:

@Bean
RestClient restClient(RestClient.Builder builder) {
    return builder.build();
}

For more fine‑grained control you can attach the filter to HttpClientSettings manually:

@Bean
RestClient restClient(RestClient.Builder builder) {
    InetAddressFilter onlyExternal = InetAddressFilter.externalAddresses();
    HttpClientSettings settings = HttpClientSettings.defaults()
        .withInetAddressFilter(onlyExternal);
    ClientHttpRequestFactory requestFactory =
        ClientHttpRequestFactoryBuilder.jdk().build(settings);
    return builder.requestFactory(requestFactory).build();
}

2.4 Verification test

Define the same /fetch endpoint for testing:

private final RestClient restClient;

@GetMapping("/fetch")
public String fetch(String url) {
    return this.restClient.get()
        .uri(URI.create(url))
        .retrieve()
        .body(String.class);
}

When the filter permits only external addresses, a request to an internal IP returns an error, while a request to a public URL succeeds. The console output and HTTP response screenshots below illustrate the behavior.

After adjusting the bean to block internal addresses:

@Bean
RestClient restClient(RestClient.Builder builder) {
    InetAddressFilter onlyExternal = InetAddressFilter.internalAddresses()
        .andNot("127.0.0.1");
    // ... additional configuration
    return builder.build();
}

These results confirm that InetAddressFilter effectively blocks SSRF attempts targeting internal networks while allowing legitimate external calls.