Proposal: Change default follow_redirects to false for http_client output (Prevent SSRF)
Maintainers usually reply within 1 day
Nobody has claimed this yet.
Assessment
- Difficulty
- 5/5
- Estimated time
- Over a week
- Newbie friendliness
- 25/100
Research direction
Start at the Benthos http_client output configuration and inventory the other HTTP-based components affected by the proposed default. Determine whether the change should apply immediately or target v5, and whether an explicit configuration warning is needed; completion requires a decided secure-by-default behavior that accounts for the stated backward-compatibility impact.
Written by the indexing model from the issue text.
Description
We've identified a potential Server-Side Request Forgery (SSRF) vulnerability tied to the Benthos http_client output component.
Currently, the follow_redirects configuration defaults to true. If Benthos is configured to interact with an external or semi-trusted endpoint, and that endpoint gets compromised or behaves maliciously, it can return a 3xx redirect pointing to an internal, non-public address (e.g., an internal API, or cloud metadata services like 169.254.169.254). Because Benthos follows redirects by default, it will unknowingly execute the SSRF attack against the internal network.
To align with a "secure-by-default" posture, we propose changing the default value of follow_redirects from true to false across all HTTP-based components. Users who genuinely need to follow redirects should be required to explicitly opt-in by setting follow_redirects: true in their configuration.
We acknowledge that changing this default is a breaking change that will likely disrupt users who implicitly rely on the current redirect behavior.
If changing the component-level default immediately is not feasible due to backward compatibility, a few alternatives could be:
- Target for next v5 release
- Linter Warning: Update the lint command to emit a warning when an HTTP component is defined without an explicit follow_redirects value, encouraging users to make a conscious choice.
We are currently exploring workarounds on our end (such as CI/CD linting), but we believe fixing this at the core would benefit the entire community by removing a subtle but significant security footgun.
- Dominant language
- Go
- Stars
- 571
- Forks
- 121
- Avg merge
- 1d 13h
- Merged PRs (30d)
- 15
Getting set up
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from redpanda-data/benthos
-
Difficulty 2/5 1-3 hours Newbie friendliness 62/100
redpanda-data/benthos#404 ·
Maintainers usually reply within 1 day
-
Difficulty 3/5 1-2 days Newbie friendliness 68/100
redpanda-data/benthos#503 ·
Maintainers usually reply within 1 day
-
Difficulty 4/5 3-5 days Newbie friendliness 55/100
redpanda-data/benthos#502 ·
Maintainers usually reply within 1 day
-
Difficulty 4/5 3-5 days Newbie friendliness 72/100
redpanda-data/benthos#481 ·
Maintainers usually reply within 1 day
-
Difficulty 3/5 1-2 days Newbie friendliness 72/100
redpanda-data/benthos#469 ·
Maintainers usually reply within 1 day
All issues in redpanda-data/benthos
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 90/100
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
NVIDIA/k8s-device-plugin#2076 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
Maintainers usually reply within 1 day
-
agentic-workflows
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
Maintainers usually reply within 1 day
-
area/release kind/bug
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
kubernetes-sigs/kueue#16455 · 1 comment ·
Maintainers usually reply within 1 day