#### [Abblix\.Oidc\.Server](https://www.abblix.com/docs/api/abblix-oidc-server 'index')
### [Abblix\.Oidc\.Server\.Features\.SecureHttpFetch](https://www.abblix.com/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.SecureHttpFetch 'Abblix\.Oidc\.Server\.Features\.SecureHttpFetch')

## SecureUriValidator Class

Default [ISecureUriValidator](https://www.abblix.com/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.SecureHttpFetch.ISecureUriValidator 'Abblix\.Oidc\.Server\.Features\.SecureHttpFetch\.ISecureUriValidator') implementation: applies the scheme allow\-list and the
internal\-hostname / private\-or\-reserved IP\-literal rules from [SecureHttpFetchOptions](https://www.abblix.com/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.SecureHttpFetch.SecureHttpFetchOptions 'Abblix\.Oidc\.Server\.Features\.SecureHttpFetch\.SecureHttpFetchOptions')\.

```csharp
public class SecureUriValidator : Abblix.Oidc.Server.Features.SecureHttpFetch.ISecureUriValidator
```

Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → SecureUriValidator

Implements [ISecureUriValidator](https://www.abblix.com/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.SecureHttpFetch.ISecureUriValidator 'Abblix\.Oidc\.Server\.Features\.SecureHttpFetch\.ISecureUriValidator')

### Remarks
A configuration that lifts the scheme restriction is reported once, when this singleton is
created, under this type's own log category\. A report rather than a refusal, because an empty
list is a statement a deployment may mean; the category makes the message separately silenceable
the same way [Abblix\.Oidc\.Server\.Features\.SecureHttpFetch\.SsrfGuardWatch](https://learn.microsoft.com/en-us/dotnet/api/abblix.oidc.server.features.securehttpfetch.ssrfguardwatch 'Abblix\.Oidc\.Server\.Features\.SecureHttpFetch\.SsrfGuardWatch')'s is\.
### Constructors

## SecureUriValidator\(IOptions\<SecureHttpFetchOptions\>, ILogger\<SecureUriValidator\>\) Constructor {#Abblix.Oidc.Server.Features.SecureHttpFetch.SecureUriValidator.SecureUriValidator(Microsoft.Extensions.Options.IOptions_Abblix.Oidc.Server.Features.SecureHttpFetch.SecureHttpFetchOptions_,Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Features.SecureHttpFetch.SecureUriValidator_)}

Creates the validator and reports a lifted scheme restriction, once, when the configuration
states one\.

```csharp
public SecureUriValidator(Microsoft.Extensions.Options.IOptions<Abblix.Oidc.Server.Features.SecureHttpFetch.SecureHttpFetchOptions> options, Microsoft.Extensions.Logging.ILogger<Abblix.Oidc.Server.Features.SecureHttpFetch.SecureUriValidator>? logger=null);
```
#### Parameters

###### `options` [Microsoft\.Extensions\.Options\.IOptions&lt;](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.options.ioptions-1 'Microsoft\.Extensions\.Options\.IOptions\`1')[SecureHttpFetchOptions](https://www.abblix.com/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.SecureHttpFetch.SecureHttpFetchOptions 'Abblix\.Oidc\.Server\.Features\.SecureHttpFetch\.SecureHttpFetchOptions')[&gt;](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.options.ioptions-1 'Microsoft\.Extensions\.Options\.IOptions\`1') {#Abblix.Oidc.Server.Features.SecureHttpFetch.SecureUriValidator.SecureUriValidator(Microsoft.Extensions.Options.IOptions_Abblix.Oidc.Server.Features.SecureHttpFetch.SecureHttpFetchOptions_,Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Features.SecureHttpFetch.SecureUriValidator_).options}

The fetch policy this validator enforces\.

###### `logger` [Microsoft\.Extensions\.Logging\.ILogger&lt;](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.logging.ilogger-1 'Microsoft\.Extensions\.Logging\.ILogger\`1')[SecureUriValidator](https://www.abblix.com/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.SecureHttpFetch.SecureUriValidator 'Abblix\.Oidc\.Server\.Features\.SecureHttpFetch\.SecureUriValidator')[&gt;](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.logging.ilogger-1 'Microsoft\.Extensions\.Logging\.ILogger\`1') {#Abblix.Oidc.Server.Features.SecureHttpFetch.SecureUriValidator.SecureUriValidator(Microsoft.Extensions.Options.IOptions_Abblix.Oidc.Server.Features.SecureHttpFetch.SecureHttpFetchOptions_,Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Features.SecureHttpFetch.SecureUriValidator_).logger}

Carries the one\-time report; absent in hosts that build the validator
            by hand, where there is nowhere to report to\.
### Methods

## SecureUriValidator\.IsAllowedDestination\(Uri, Uri\[\]\) Method {#Abblix.Oidc.Server.Features.SecureHttpFetch.SecureUriValidator.IsAllowedDestination(System.Uri,System.Uri[])}

Reports whether a URI is one of the destinations named in
[AllowedDestinations](https://www.abblix.com/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.SecureHttpFetch.SecureHttpFetchOptions#Abblix.Oidc.Server.Features.SecureHttpFetch.SecureHttpFetchOptions.AllowedDestinations 'Abblix\.Oidc\.Server\.Features\.SecureHttpFetch\.SecureHttpFetchOptions\.AllowedDestinations')\.

```csharp
public static bool IsAllowedDestination(System.Uri uri, System.Uri[]? allowedDestinations);
```
#### Parameters

###### `uri` [System\.Uri](https://learn.microsoft.com/en-us/dotnet/api/system.uri 'System\.Uri') {#Abblix.Oidc.Server.Features.SecureHttpFetch.SecureUriValidator.IsAllowedDestination(System.Uri,System.Uri[]).uri}

The URI about to be reached\.

###### `allowedDestinations` [System\.Uri](https://learn.microsoft.com/en-us/dotnet/api/system.uri 'System\.Uri')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') {#Abblix.Oidc.Server.Features.SecureHttpFetch.SecureUriValidator.IsAllowedDestination(System.Uri,System.Uri[]).allowedDestinations}

The configured permissions, which may be absent\.

#### Returns
[System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean')  
`true` when the URI matches one of them\.

### Remarks
Static because two separate refusals have to honour the same permission: the synchronous policy
below, and the DNS re\-resolution in [SsrfValidatingHttpMessageHandler](https://www.abblix.com/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.SecureHttpFetch.SsrfValidatingHttpMessageHandler 'Abblix\.Oidc\.Server\.Features\.SecureHttpFetch\.SsrfValidatingHttpMessageHandler')\. A permission
honoured by only one of them passes validation and then dies at the request \- which reads as a
working allow\-list in every test of this class, and fails only against a live service\.

An entry with no path of its own (`/`) matches the whole origin; an entry carrying a path
matches that path exactly. Comparison of scheme and host ignores case as RFC 3986 Section 6.2.2.1
requires, while the path is compared as written, because the same section leaves it case-sensitive.

## SecureUriValidator\.IsInternalHostname\(string\) Method {#Abblix.Oidc.Server.Features.SecureHttpFetch.SecureUriValidator.IsInternalHostname(string)}

Checks if a hostname appears to be internal or non\-public\.

```csharp
public static bool IsInternalHostname(string hostname);
```
#### Parameters

###### `hostname` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Features.SecureHttpFetch.SecureUriValidator.IsInternalHostname(string).hostname}

#### Returns
[System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean')

### Remarks
The rules live in [PrivateNetworks](https://www.abblix.com/docs/api/abblix-utils/Abblix.Utils.PrivateNetworks 'Abblix\.Utils\.PrivateNetworks'), where every package that must refuse such an address
reads them, so a name added there takes effect here too\. The wording of this member is kept as shipped:
it is public, and a rename would break a host that calls it for nothing but a synonym\.

## SecureUriValidator\.IsPrivateOrReservedAddress\(IPAddress\) Method {#Abblix.Oidc.Server.Features.SecureHttpFetch.SecureUriValidator.IsPrivateOrReservedAddress(System.Net.IPAddress)}

Checks if an IP address is private, loopback, link\-local, or otherwise reserved\.

```csharp
public static bool IsPrivateOrReservedAddress(System.Net.IPAddress address);
```
#### Parameters

###### `address` [System\.Net\.IPAddress](https://learn.microsoft.com/en-us/dotnet/api/system.net.ipaddress 'System\.Net\.IPAddress') {#Abblix.Oidc.Server.Features.SecureHttpFetch.SecureUriValidator.IsPrivateOrReservedAddress(System.Net.IPAddress).address}

#### Returns
[System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean')

### Remarks
Delegates to [PrivateNetworks](https://www.abblix.com/docs/api/abblix-utils/Abblix.Utils.PrivateNetworks 'Abblix\.Utils\.PrivateNetworks') for the same reason as the hostname rules above\.

## SecureUriValidator\.Validate\(Uri\) Method {#Abblix.Oidc.Server.Features.SecureHttpFetch.SecureUriValidator.Validate(System.Uri)}

Validates a URI against the configured SSRF policy without resolving DNS\.

```csharp
public string? Validate(System.Uri uri);
```
#### Parameters

###### `uri` [System\.Uri](https://learn.microsoft.com/en-us/dotnet/api/system.uri 'System\.Uri') {#Abblix.Oidc.Server.Features.SecureHttpFetch.SecureUriValidator.Validate(System.Uri).uri}

The URI to validate\.

Implements [Validate\(Uri\)](https://www.abblix.com/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.SecureHttpFetch.ISecureUriValidator#Abblix.Oidc.Server.Features.SecureHttpFetch.ISecureUriValidator.Validate(System.Uri) 'Abblix\.Oidc\.Server\.Features\.SecureHttpFetch\.ISecureUriValidator\.Validate\(System\.Uri\)')

#### Returns
[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')  
`null` when the URI is allowed; otherwise a human\-readable reason for the rejection\.