#### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index')

## Abblix\.Oidc\.Server\.Features\.SecureHttpFetch Namespace

| Classes | |
| :--- | :--- |
| [CachingSecureHttpFetcherDecorator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.SecureHttpFetch.CachingSecureHttpFetcherDecorator 'Abblix\.Oidc\.Server\.Features\.SecureHttpFetch\.CachingSecureHttpFetcherDecorator') | A decorator for [ISecureHttpFetcher](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.SecureHttpFetch.ISecureHttpFetcher 'Abblix\.Oidc\.Server\.Features\.SecureHttpFetch\.ISecureHttpFetcher') that adds caching capabilities\. Caches successful responses for the configured duration to reduce network calls and improve performance\. |
| [ErrorFactory](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.SecureHttpFetch.ErrorFactory 'Abblix\.Oidc\.Server\.Features\.SecureHttpFetch\.ErrorFactory') | A static factory class for creating OIDC error instances related to secure HTTP fetching operations\. |
| [SecureHttpFetcher](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.SecureHttpFetch.SecureHttpFetcher 'Abblix\.Oidc\.Server\.Features\.SecureHttpFetch\.SecureHttpFetcher') | Securely fetches content from external URIs with SSRF protection\. This class should be registered with AddHttpClient for proper HTTP client configuration\. |
| [SecureHttpFetcherExtensions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.SecureHttpFetch.SecureHttpFetcherExtensions 'Abblix\.Oidc\.Server\.Features\.SecureHttpFetch\.SecureHttpFetcherExtensions') | Provides reusable functionality for fetching JSON Web Key Sets \(JWKS\) from remote URIs with SSRF protection and consistent error handling\. |
| [SecureHttpFetchOptions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.SecureHttpFetch.SecureHttpFetchOptions 'Abblix\.Oidc\.Server\.Features\.SecureHttpFetch\.SecureHttpFetchOptions') | Configuration options for secure HTTP fetching with SSRF protection\. |
| [SecureUriValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.SecureHttpFetch.SecureUriValidator 'Abblix\.Oidc\.Server\.Features\.SecureHttpFetch\.SecureUriValidator') | Default [ISecureUriValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.SecureHttpFetch.ISecureUriValidator 'Abblix\.Oidc\.Server\.Features\.SecureHttpFetch\.ISecureUriValidator') implementation: applies the scheme allow\-list and the internal\-hostname / private\-or\-reserved IP\-literal rules from [SecureHttpFetchOptions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.SecureHttpFetch.SecureHttpFetchOptions 'Abblix\.Oidc\.Server\.Features\.SecureHttpFetch\.SecureHttpFetchOptions')\. |
| [SsrfHttpClientServiceCollectionExtensions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.SecureHttpFetch.SsrfHttpClientServiceCollectionExtensions 'Abblix\.Oidc\.Server\.Features\.SecureHttpFetch\.SsrfHttpClientServiceCollectionExtensions') | Registers HTTP clients that initiate requests to client\-supplied URLs \(CIBA notification endpoints, back\-channel logout URIs, JWKS/issuer fetches\)\. Every such client must route through [SsrfValidatingHttpMessageHandler](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.SecureHttpFetch.SsrfValidatingHttpMessageHandler 'Abblix\.Oidc\.Server\.Features\.SecureHttpFetch\.SsrfValidatingHttpMessageHandler'); bundling the handler with the client registration makes it impossible to add a new outbound client that silently skips SSRF protection\. |
| [SsrfValidatingHttpMessageHandler](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.SecureHttpFetch.SsrfValidatingHttpMessageHandler 'Abblix\.Oidc\.Server\.Features\.SecureHttpFetch\.SsrfValidatingHttpMessageHandler') | HTTP message handler that prevents SSRF attacks through comprehensive validation: 1\. Hostname\-based blocking \(localhost, internal, \.local TLDs, etc\.\) 2\. DNS resolution and IP\-based blocking \(private ranges, loopback, link\-local\) 3\. Re\-validation immediately before HTTP request to prevent DNS rebinding \(TOCTOU attacks\) |

| Interfaces | |
| :--- | :--- |
| [ISecureHttpFetcher](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.SecureHttpFetch.ISecureHttpFetcher 'Abblix\.Oidc\.Server\.Features\.SecureHttpFetch\.ISecureHttpFetcher') | Defines a contract for securely fetching content from external URIs with SSRF protection\. |
| [ISecureUriValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.SecureHttpFetch.ISecureUriValidator 'Abblix\.Oidc\.Server\.Features\.SecureHttpFetch\.ISecureUriValidator') | Applies the synchronous portion of the SSRF policy \(scheme allow\-list, internal\-hostname and private/reserved IP\-literal blocking\) configured by [SecureHttpFetchOptions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.SecureHttpFetch.SecureHttpFetchOptions 'Abblix\.Oidc\.Server\.Features\.SecureHttpFetch\.SecureHttpFetchOptions') to a URI\. Used both by the outbound HTTP handler immediately before a request and at registration time to reject client\-supplied URIs the server would later fetch \(e\.g\. a back\-channel logout endpoint\)\. |