Docs / Security & access

Where your calls may go

Every socket the platform opens outward is judged against where it goes, not just against its URL. This is the answer to the oldest trick with a configurable HTTP client: pointing it at the machine’s own network, or at the cloud’s metadata service, from inside.

Three classes of address

• Cloud metadata addresses are refused always. No policy can allow them.
• Private address space is denied unless allowed. A tenant admin allows ranges per environment, in the browser, on the tenant’s panel. The list is a policy of the environment and travels nowhere.
• Public addresses are allowed, and an environment can additionally name the hosts it may call — an opt-in allow list for API calls, token endpoints and mail servers alike; an empty list means any host.

The address a call goes to comes from the connection it is made on — see Connections and functions.

Where the judgement happens

The same rule at every place an address is typed or resolved: on the connection form (a base URL or a token URL inside the refused set is refused on Activate), on the token endpoint of an OAuth or JWT connection, and at connect time for every call and every mail — the name is resolved, every resolved address is judged, and the socket is pinned to a judged one, so a name cannot answer one address to the check and another to the connection. A refused call is reported as blocked, does not repeat, and does not count against the connection’s circuit.

What a partner sees

Every call carries a User-Agent naming a9script and its version, and the installation’s status page reports the outbound address the operator configured, so a partner can allow-list it. The installation never guesses that address.

When a connection keeps failing

When a connection’s calls meet transport faults or 5xx answers in a row, its circuit opens: further calls are refused with a message that names the connection, how long the circuit has been open, the count, the route that counted and the next probe. The connection turns red until somebody acknowledges it. A 4xx never counts; a refused-by-policy call never counts.

In the beta

The installation’s network is not yours: a system reachable only inside your network cannot be called from the beta, whatever ranges you allow — see In the beta.