- How do I install jaybizzle/safeurl in a Laravel application?
- Install it with Composer by running composer require jaybizzle/safeurl, then commit the resulting composer.json and composer.lock changes. It is a leaf utility package with no migrations, queue workers, or heavy service-provider bootstrapping, so there is typically no config publishing or facade registration step. Treat it as a guard you call at the specific boundaries where user-supplied URLs are accepted or fetched, rather than a global request filter.
- Which Laravel and PHP versions does jaybizzle/safeurl support?
- Version 1.2.0 is a Composer constraint change that adds ^13.0 alongside the previously supported Laravel releases, so it fits Laravel 10, 11, 12, and 13 estates. Before upgrading, confirm the package's PHP version floor matches your runtime and that no transitive dependency conflicts with the Guzzle or PSR versions pinned elsewhere in your app. Also check whether the project's CI matrix actually exercises Laravel 13 rather than assuming the widened constraint was runtime-verified.
- How does jaybizzle/safeurl help prevent SSRF in a Laravel app?
- The package validates and sanitizes URLs before use by checking the scheme, host, and allowed domains, and by confirming a URL resolves to a public rather than private address before it is fetched or stored. That makes it useful for link previews, webhook registration, avatar and image import, RSS ingestion, and OAuth callback URLs. It reduces exposure to malicious links and internal-network access, but it is one layer of defense and should be paired with network egress controls.
- Can safeurl validate redirect and callback URLs to prevent open redirects?
- Yes. Validating the scheme and host and restricting to an allowlist of domains is exactly the check needed before passing a user-supplied URL to a redirect or storing a callback endpoint. The important detail is that the allowlist must be strict, since a validator that approves the first URL still gives false assurance if the HTTP client is later allowed to follow a redirect to an internal address. Keep the validation close to the redirect or fetch call site so the check cannot be bypassed.
- Does safeurl re-validate redirect targets when the HTTP client follows redirects?
- Redirect re-validation is the key question to confirm against the source and README before relying on the package for outbound fetches. If only the initial URL is checked, a server that answers with a 302 to 169.254.169.254 or 127.0.0.1 can walk your client straight into the internal network. The safe pattern is to disable automatic redirect following and validate each hop yourself, or to re-validate the final resolved address before connecting.
- How does safeurl handle DNS rebinding and time-of-check-to-time-of-use risks?
- Any validator that resolves a hostname at validation time cannot guarantee that the same address is used moments later when the request is actually made, which is the classic DNS rebinding window. For high-risk fetches you should resolve once, validate the resulting IP, and then connect to that pinned IP rather than re-resolving the hostname. Ask the maintainer directly whether there is a documented posture on DNS rebinding, since the README may not spell it out.
- Which private IP ranges and IP encodings does safeurl block?
- A robust URL safety check needs to cover IPv4 private and reserved ranges, IPv6 unique-local and link-local addresses, IPv4-mapped IPv6 forms, decimal, octal, and hex IP encodings, and hostnames that resolve to multiple mixed public and private records. Verify the package's coverage against your own test cases, especially the exotic encodings that are easy to miss. Do not assume full coverage without reading the implementation or running SSRF-specific tests in your suite.
- Can I use safeurl in queued jobs and console commands instead of form validation?
- That depends on whether the package exposes a plain value-object API in addition to any Laravel ValidationRule, since a rule is only convenient inside HTTP request validation. Fetches often happen in queued jobs and scheduled commands, so the validation must be callable from those contexts too. Check the README and source for a directly invokable class you can use from a job's handle method before designing around it.
- Is jaybizzle/safeurl actively maintained and safe for production use?
- It is a single-author package in a security-sensitive role, so weigh bus factor alongside the feature set. The Laravel 13 constraint bump in 1.2.0 is a positive maintenance signal, but it is not a durability guarantee on its own. Review release cadence, historical time-to-patch for security fixes, and whether the package is a thin wrapper over a better-maintained library; if it is, track that upstream project's advisories as well.
- What are alternatives to jaybizzle/safeurl for URL and SSRF protection in Laravel?
- Alternatives include URI parsing libraries such as league/uri, Guzzle middleware that inspects and blocks requests to private address space, and platform-level egress filtering or a proxy that only allows public destinations. Many teams combine a small validator like safeurl with a hardened HTTP client configured to disable redirects and pin resolved IPs. Evaluate alternatives on redirect handling, IPv6 and encoded-IP coverage, and how actively the maintainers respond to security reports.