Lightning.AuthProviders.OauthHTTPClient.PinnedAdapter (Lightning v2.19.0-pre)

View Source

A Tesla adapter for outbound OAuth requests that defends against SSRF and DNS rebinding.

User-controlled endpoint URLs (token, userinfo, revocation, introspection) are SSRF sinks. Before any socket is opened, the request host is resolved and validated with Philter.Egress, which fails closed and blocks internal or reserved addresses. The connection is then pinned to a validated IP address (never re-resolving the hostname), so DNS cannot swap in an internal address between validation and connect.

For HTTPS, TLS peer verification is always forced on: SNI and certificate hostname verification run against the original hostname via Mint's :hostname option, and any caller-supplied :verify/:verify_fun is dropped so verification cannot be weakened. Redirects are never followed.

The error surfaced to callers is deliberately generic (:egress_blocked); the specific egress reason is logged server-side only and never leaked, so the adapter cannot be used as an internal-network oracle.

Configuration

Policy is read from Application.get_env(:lightning, __MODULE__, []) and merged with per-request adapter options:

  • :block_private_networks - block internal ranges. Default true.
  • :allowed_hosts - host strings that bypass the block. Default [].
  • :connect_timeout - overall connect budget in ms. Default 5_000.
  • :receive_timeout - per-recv timeout in ms. Default 15_000.
  • :resolver - a 2-arity resolver, as Philter.Egress documents.
  • :transport_opts - extra TLS options (private CA, client cert).