43 lines
1.7 KiB
C#
43 lines
1.7 KiB
C#
namespace w4c_workflows.Services.Security;
|
|
|
|
/// <summary>
|
|
/// Operator policy for outbound HTTP issued by workflow nodes. Bound from the
|
|
/// <c>Nodes:Egress</c> configuration section. The defaults are fail-closed:
|
|
/// private, loopback, link-local and other reserved ranges are denied unless an
|
|
/// operator explicitly opts in through <see cref="AllowedHosts"/> or
|
|
/// <see cref="AllowPrivateNetworks"/>.
|
|
/// </summary>
|
|
public sealed class EgressPolicyOptions
|
|
{
|
|
/// <summary>Configuration section this policy binds from.</summary>
|
|
public const string SectionName = "Nodes:Egress";
|
|
|
|
/// <summary>
|
|
/// Permit requests whose target resolves into a private or reserved range.
|
|
/// Leave <c>false</c> in hosted environments; opt in per host instead.
|
|
/// </summary>
|
|
public bool AllowPrivateNetworks { get; set; }
|
|
|
|
/// <summary>
|
|
/// Schemes a node may target. Anything outside the list is rejected, which
|
|
/// keeps file/gopher/data URIs out of the HTTP executor entirely.
|
|
/// </summary>
|
|
public string[] AllowedSchemes { get; set; } = ["https", "http"];
|
|
|
|
/// <summary>
|
|
/// Explicit allow-list of hosts that bypass the address-range checks (for
|
|
/// example a documented internal API). Supports an exact host and a
|
|
/// <c>*.example.com</c> suffix wildcard.
|
|
/// </summary>
|
|
public string[] AllowedHosts { get; set; } = [];
|
|
|
|
/// <summary>Explicit deny-list of hosts; a match always blocks the request.</summary>
|
|
public string[] BlockedHosts { get; set; } = [];
|
|
|
|
/// <summary>
|
|
/// Hard ceiling for redirects a single node invocation may follow. A
|
|
/// workflow can ask for fewer, never more.
|
|
/// </summary>
|
|
public int MaxRedirects { get; set; } = 5;
|
|
}
|