roundly-consulting / safe-fetch-for-laravel

1.0.2 2026-11-08 19:54 UTC

Requires

• php: ^8.4
• illuminate/console: ^13.0
• illuminate/contracts: ^13.0
• illuminate/http: ^13.0
• illuminate/support: ^13.0
• illuminate/translation: ^13.0
• illuminate/validation: ^13.0
• roundly-consulting/enums-for-laravel: ^2.0
• roundly-consulting/package-toolkit-for-laravel: ^2.0

Requires (Dev)

• larastan/larastan: ^3.0
• laravel/pint: ^1.18
• nunomaduro/collision: ^8.5
• orchestra/testbench: ^11.0
• pestphp/pest: ^5.0
• pestphp/pest-plugin-arch: ^5.0
• pestphp/pest-plugin-laravel: ^5.0
• phpstan/extension-installer: ^1.4
• roundly-consulting/testing-for-laravel: ^2.0

Suggests

• ext-curl: Required to send guarded requests: DNS pinning uses CURLOPT_RESOLVE. Without it vet(), allows() and precheck() still judge URLs, but Http::safe(), guard(), http(), fetch(), download() and VettedDestination::pinningOptions() refuse with cannot_pin.
• ext-intl: International (IDN) host names; without it they are refused.

MIT

• Andrej Mihaliak

• security
• ssrf
• http-client
• url-validation
• dns-pinning
• private-network
• outbound-requests

Published on Packagist.org on 2026-11-08 19:55 UTC

README

Safe Fetch for Laravel

Make server-side requests to URLs you do not control — webhook targets, link previews, avatar, feed and import URLs — without reaching your own network. Every URL is parsed strictly, every address it resolves to must be public, and the connection is pinned to exactly those addresses, redirects included.

Installation

Requires PHP 8.4 and Laravel 13; ext-curl to send requests (ext-intl for international host names).

composer require roundly-consulting/safe-fetch-for-laravel

Usage

Validate a URL a user hands in, then fetch it — capped, with errors that say whether a retry can help:

use Illuminate\Support\Facades\Http;
use RoundlyConsulting\SafeFetch\Exceptions\SafeFetchException;
use RoundlyConsulting\SafeFetch\Facades\SafeFetch;
use RoundlyConsulting\SafeFetch\Rules\SafeUrl;

$request->validate(['feed' => ['required', 'string', 'max:2048', new SafeUrl]]);

try {
    $feed = SafeFetch::fetch($request->input('feed'), maxBytes: 2_000_000);
    // $feed->body, $feed->contentType, $feed->url
} catch (SafeFetchException $e) {
    $e->retryable(); // a 5xx or a timeout can heal; a blocked address never does
}

Or guard any Laravel HTTP call:

Http::safe()->withToken($token)->post($hookUrl, $payload);

Documentation

The full documentation — configuration, every feature and its API, and testing — lives on our website: roundly-consulting.com/open-source/docs/safe-fetch-for-laravel

Release notes are in CHANGELOG.md. To contribute, see the contributing guide.

Support our work

This package is free and open source, built and maintained by Roundly Consulting. If it saves you time, please consider supporting our open-source work — a one-time donation, a monthly pledge on Patreon or a crypto donation helps fund maintenance, new features and new packages.

License

The MIT License (MIT). See LICENSE.md.