---
title: "Safe Fetch for Laravel — docs | Roundly"
description: "Developer docs for Safe Fetch for Laravel: SSRF protection for the HTTP client with DNS pinning, blocked private and metadata addresses and a URL rule."
url: https://roundly-consulting.com/open-source/docs/safe-fetch-for-laravel
language: en
---

[All packages](https://roundly-consulting.com/open-source.md)

Open source

# Safe Fetch for Laravel

Install

`composer require roundly-consulting/safe-fetch-for-laravel`

Requires: PHP ^8.4 · Laravel ^13.0

[GitHub](https://github.com/roundly-consulting/safe-fetch-for-laravel) [Packagist](https://packagist.org/packages/roundly-consulting/safe-fetch-for-laravel) [Donate (opens in a new tab)](https://donate.stripe.com/dRmeVe8FX5PF1Qd9pXcEw00) [Patreon](https://www.patreon.com/cw/roundly)

## Overview

SSRF protection for Laravel’s HTTP client. Make server-side requests to URLs you do not control — webhook targets, link previews, avatar, feed and import URLs — without reaching your own network. Every URL is parsed strictly and rebuilt, every address its host resolves to must be public, and the connection is pinned to exactly those addresses, redirects included. MIT-licensed, no database, built only on Laravel’s HTTP client and Roundly’s enums and package-toolkit.

### What you get

#### One call on any request

Http::safe() guards the Laravel HTTP calls you already write — tokens, retries, pools and other middleware keep working. SafeFetch::guard() and http() do the same without the macro.

#### Internal destinations refused

Private, loopback, link-local, carrier-grade NAT and cloud-metadata addresses — AWS, Google Cloud, Azure, Alibaba, Oracle, OpenStack — in every spelling: numeric forms, IPv4 inside IPv6, names that point inside.

#### DNS pinned, connection checked

The name is resolved once, every address judged, curl pinned to exactly those with no proxy and no reused connection, and the connected address checked before a byte is sent and again afterwards.

#### Redirects under control

Off by default. When on, every hop is vetted and pinned again, with a hop limit, no https to http, credentials kept to the first origin and only the headers you name forwarded.

#### Capped fetch and download

fetch() reads a GET into memory, download() streams it to a file swapped in only on success — both with a byte cap counted after decoding, one time budget and errors that say whether a retry can help.

#### Validation, events and a health check

The SafeUrl rule and safe\_url with one neutral message, a DestinationRefused event for every refusal, and safe-fetch:check for a URL’s verdict or the environment, as text or JSON.

#### Facade, DI or actions

One SafeFetch facade, an injectable manager or single-purpose actions — plus a recording fake that keeps the real guard and a DNS table for tests.

### Documentation

#### [Use cases](https://roundly-consulting.com/open-source/docs/safe-fetch-for-laravel/use-cases.md)

Where the package fits — webhook senders, link previews, imports and media from URLs, customer-configured integrations and SSRF alerting.

#### [Installation](https://roundly-consulting.com/open-source/docs/safe-fetch-for-laravel/installation.md)

Install via Composer — no migrations, safe defaults — then optionally publish the config and translations and check the environment.

#### [Configuration](https://roundly-consulting.com/open-source/docs/safe-fetch-for-laravel/configuration.md)

Every key of config/safe-fetch.php — http, ports, host and range lists, the app-host block, redirects, the fetch cap and budget, the resolver.

#### [The SafeFetch facade](https://roundly-consulting.com/open-source/docs/safe-fetch-for-laravel/facade.md)

Tour the SafeFetch facade — vet, allows, precheck, guard, http, fetch, download, truncated, policy, networks, urls — and the Http::safe() macro.

#### [DI and actions](https://roundly-consulting.com/open-source/docs/safe-fetch-for-laravel/without-facade.md)

Skip the facade: inject SafeFetchManager or call a single-purpose action — every action with its execute() signature and facade method.

#### [Guarded requests](https://roundly-consulting.com/open-source/docs/safe-fetch-for-laravel/guarded-requests.md)

Http::safe() step by step — the pinned curl handler, per-hop vetting, pre-send and post-checks, refused options, pools, retries and the response cap.

#### [Fetch and download](https://roundly-consulting.com/open-source/docs/safe-fetch-for-laravel/fetch-and-download.md)

SafeFetch::fetch() reads a capped, guarded GET into memory; download() streams it to a file swapped in only on success. Failures and retries.

#### [Validation and precheck](https://roundly-consulting.com/open-source/docs/safe-fetch-for-laravel/validation.md)

The SafeUrl rule and the safe\_url string rule with one neutral message, SafeUrl::withoutLookup() and SafeFetch::precheck() for save time.

#### [Destination policy](https://roundly-consulting.com/open-source/docs/safe-fetch-for-laravel/policies.md)

DestinationPolicy — the withers that tighten or loosen per call, host patterns, the order of the rules, private hosts and a policy built from scratch.

#### [Redirects](https://roundly-consulting.com/open-source/docs/safe-fetch-for-laravel/redirects.md)

Redirects are off by default; when on, every hop is vetted and pinned, with a hop limit, no downgrade, credentials and cookies kept per origin.

#### [URLs and blocked networks](https://roundly-consulting.com/open-source/docs/safe-fetch-for-laravel/urls-and-networks.md)

How URLs are canonicalised, the 26 blocked ranges, IPv4 inside IPv6, cloud-metadata endpoints, the inspection helpers and a resolver of your own.

#### [Verdicts and exceptions](https://roundly-consulting.com/open-source/docs/safe-fetch-for-laravel/errors.md)

The Reason enum, the exception hierarchy, retryable() and blockedBy(), neutral messages that never name the URL, and the named constructors.

#### [Events](https://roundly-consulting.com/open-source/docs/safe-fetch-for-laravel/events.md)

DestinationRefused fires on every refusal with the reason, host, rule and where it was judged — never the URL — ready for SSRF alerting.

#### [Artisan commands](https://roundly-consulting.com/open-source/docs/safe-fetch-for-laravel/commands.md)

safe-fetch:check judges a URL or checks the environment, as text or JSON; php artisan about shows the active policy as counts only.

#### [Use in your own package](https://roundly-consulting.com/open-source/docs/safe-fetch-for-laravel/consumer-packages.md)

Recipes for packages that fetch their users’ URLs — a policy that drops the host’s carve-outs, the manager, throttling, retries and save-time prechecks.

#### [Threat model](https://roundly-consulting.com/open-source/docs/safe-fetch-for-laravel/threat-model.md)

What the guard defends against — rebinding, disguised addresses, redirects, proxies, parser tricks, leaky errors — and what it does not guarantee.

#### [Testing](https://roundly-consulting.com/open-source/docs/safe-fetch-for-laravel/testing.md)

SafeFetch::fake() records every verdict and keeps the real guard; fakeDns() answers lookups from a table; every assertion and the pin in a test.

#### [Requirements](https://roundly-consulting.com/open-source/docs/safe-fetch-for-laravel/requirements.md)

PHP 8.4+, Laravel 13, ext-curl to send guarded requests, ext-intl for international names, two Roundly packages — no database.

## Show your open-source love

This package is free and MIT-licensed. If it saves you time, a one-off donation or a Patreon membership keeps it maintained, tested and documented.

[More ways to support, including crypto](https://roundly-consulting.com/support-us.md)

By donating, you agree to our [donation terms](https://roundly-consulting.com/donation-terms.md).

[Support our open source work (opens in a new tab)](https://donate.stripe.com/dRmeVe8FX5PF1Qd9pXcEw00) [Join us on Patreon (opens in a new tab)](https://www.patreon.com/cw/roundly)

## Want this built into your product?

We integrate our packages into custom Laravel and AI builds. Tell us what you're working on and we'll reply within 48 hours.

[Get a quote in 48 hours](https://roundly-consulting.com/contact.md) [Browse all packages](https://roundly-consulting.com/open-source.md)