---
title: "Use cases — Safe Fetch for Laravel | Roundly"
description: "Where the package fits — webhook senders, link previews, imports and media from URLs, customer-configured integrations and SSRF alerting."
url: https://roundly-consulting.com/open-source/docs/safe-fetch-for-laravel/use-cases
language: en
---

[All packages](https://roundly-consulting.com/open-source.md)

[Safe Fetch for Laravel](https://roundly-consulting.com/open-source/docs/safe-fetch-for-laravel.md)

# Use cases

Fetching a URL someone else handed in lets them choose where your server connects. That is how server-side request forgery (SSRF) reaches what was never meant to be on the internet: the cloud provider’s metadata service that hands out credentials, databases and admin panels on the private network, or the app itself from the inside. Checking the URL’s text is not enough — an address can be written in disguise, a name can point inside, a name can answer differently a moment later, a redirect can lead inside and a proxy can look the name up again on its own. Safe Fetch for Laravel closes those paths for every request that goes through it.

- Webhook senders — the endpoint form rejects an internal address straight away; when an event fires, the request goes out through the guard, a redirect is checked hop by hop, credentials stay with the first origin, and a refusal is reported as final, so the job stops retrying.
- Link previews — a pasted link is read with a size and time cap, so a huge or never-ending page cannot tie up a worker, and a link that points inside gets the same neutral message as one that does not exist.
- Imports from a URL — a product feed or a spreadsheet is streamed to disk under a byte cap without filling memory, and a failed download leaves the previous file untouched.
- Avatars, feeds and media by URL — fetch() returns the body, content type and final URL, with errors that say whether a retry later can help and how long the server asked you to wait.
- Integrations that call customer-configured endpoints — a per-call policy restricts hosts, ports and redirects, and a package that fetches its own users’ URLs can drop the exceptions the app made for its internal services while keeping every block.
- Security monitoring — every refusal raises DestinationRefused with the reason, the host, the rule and where it was refused, never the URL, so alerting can ignore a mistyped form entry and catch an attempt on the network.

What it does not do: it protects only the requests that go through it — a plain Http::get() elsewhere is not checked. It does not inspect what a response contains, cache responses or follow robots.txt. It does not work through an outbound proxy: it connects directly, bypasses proxies taken from the environment and refuses one it is told to use. And PHP offers no way to put a time limit on the DNS lookup itself.

## Show your open-source love

This package is free and MIT-licensed. If it saves you time, a one-off donation or a Patreon membership keeps it maintained, tested and documented.

[More ways to support, including crypto](https://roundly-consulting.com/support-us.md)

By donating, you agree to our [donation terms](https://roundly-consulting.com/donation-terms.md).

[Support our open source work (opens in a new tab)](https://donate.stripe.com/dRmeVe8FX5PF1Qd9pXcEw00) [Join us on Patreon (opens in a new tab)](https://www.patreon.com/cw/roundly)

## Want this built into your product?

We integrate our packages into custom Laravel and AI builds. Tell us what you're working on and we'll reply within 48 hours.

[Get a quote in 48 hours](https://roundly-consulting.com/contact.md) [Browse all packages](https://roundly-consulting.com/open-source/docs/safe-fetch-for-laravel.md)