Fetch user-supplied URLs without opening a hole in your network

Where it goes wrong

Writing this yourself means a blocklist that is never quite complete: decimal and octal IP encodings, IPv4-mapped IPv6, DNS that answers differently on the second lookup, and a redirect that lands on 169.254.169.254. One missed case is a cloud credential leak.

What Backfire handles

• One request shape covers previews, feeds, JSON APIs and binary downloads.
• Blocked targets are refused with a machine-readable blocked_target code you can surface to the user.
• Redirects come back to you with their location header so you can decide, not the attacker.
• Each fetch is logged with the exact URL that was requested, which is what you need during an incident.

The request

POST /functions/forward
Authorization: Bearer backfire_…_api

{
  "url": "https://example.com/article",
  "method": "GET",
  "timeout_ms": 8000
}

# refused before any connection is opened:
# { "ok": false, "error": { "code": "blocked_target" } }

All use cases