{"slug": "from-custom-code-to-mature-library-why-i-replaced-my-ssrf-protection-with", "title": "From Custom Code to Mature Library: Why I Replaced My SSRF Protection with requests-hardened", "summary": "A developer replaced a custom SSRF protection implementation in a PyTorch torchtitan PR with the requests-hardened library after maintainer @shuhuayu advised against re-implementing safety guards. The custom code, which handled DNS resolution, IP range validation, and manual redirect following, carried a documented TOCTOU DNS rebinding limitation; requests-hardened filters private, loopback, and link-local addresses at the transport adapter level, including cloud metadata endpoints like 169.254.169.254.", "body_md": "Last week I submitted a PR to pytorch/torchtitan adding SSRF protection to the image decoder URL fetcher. My initial approach was a full custom implementation — resolving DNS, validating each IP against private/loopback/link-local ranges, manually following redirects with per-hop validation, all bounded to 10 hops.\n\nIt worked. But a maintainer (@shuhuayu) gave direct feedback: \"titan should not re-implement these safety guards — delegate to a mature third-party library like requests-hardened.\"\n\nMy custom implementation had a documented TOCTOU (DNS rebinding) limitation — I noted it in the docstring but couldnt fully fix it without DNS pinning. Every line of custom security code is:\n\nrequests-hardened performs IP filtering at the transport adapter level — the HTTP adapter intercepts every connection attempt and rejects private/loopback/link-local addresses (including cloud metadata endpoints like 169.254.169.254).\n\nKey advantages:\n\nThe code went from custom DNS resolution + IP validation + manual redirect loop to:\n\n```\nsession = requests_hardened.HTTPSession(\n    requests_hardened.Config(\n        ip_filter_enable=True,\n        ip_filter_allow_loopback_ips=False,\n        never_redirect=False,\n        default_timeout=(5.0, 10.0),\n    )\n)\n```\n\nEvery open-source maintainer knows this rule: if a mature, battle-tested library exists for a security-critical concern, use it. Custom implementations inevitably miss edge cases that the library authors already solved.\n\nThe PR went from \"custom SSRF protection\" to \"uses requests-hardened\". Smaller diff, stronger security.\n\nFollow my bug bounty journey on GitHub [@truongsontung](https://dev.to/truongsontung)", "url": "https://wpnews.pro/news/from-custom-code-to-mature-library-why-i-replaced-my-ssrf-protection-with", "canonical_source": "https://dev.to/truongsontung/from-custom-code-to-mature-library-why-i-replaced-my-ssrf-protection-with-requests-hardened-3kd6", "published_at": "2026-09-10 00:51:11+00:00", "updated_at": "2026-09-10 01:17:56.595430+00:00", "lang": "en", "topics": ["ai-infrastructure", "developer-tools", "ai-safety"], "entities": ["PyTorch", "torchtitan", "requests-hardened", "@shuhuayu", "@truongsontung", "GitHub"], "alternates": {"html": "https://wpnews.pro/news/from-custom-code-to-mature-library-why-i-replaced-my-ssrf-protection-with", "markdown": "https://wpnews.pro/news/from-custom-code-to-mature-library-why-i-replaced-my-ssrf-protection-with.md", "text": "https://wpnews.pro/news/from-custom-code-to-mature-library-why-i-replaced-my-ssrf-protection-with.txt", "jsonld": "https://wpnews.pro/news/from-custom-code-to-mature-library-why-i-replaced-my-ssrf-protection-with.jsonld"}}