Skip to content
AurionAI

Allowed private addresses (SSRF allowlist)

5 min readBy Emmanuel Yazbeck

AurionAI checks every address that a workflow calls, to protect your organization and AurionAI against requests to internal systems. By default, a workflow can call public addresses only. On the SSRF Allowlist page, an administrator can open specific private-network addresses for the HTTP Request and Send Webhook steps of your workflows.

Availability: Helpdesk and AI Voice + Helpdesk profiles. Administrators only.

Prerequisites

  • You have the Owner or Admin role. Other users see Access Denied.
  • Your organization uses the Helpdesk or the AI Voice + Helpdesk profile.

What an entry does

  • An entry lets the HTTP Request and Send Webhook steps of your workflows call that private-network address. The entry applies only to your organization.
  • An entry opens every port of the address. It does not limit the request to one port.
  • Public addresses work without an entry.
  • AurionAI always blocks loopback addresses (localhost, 127.0.0.1, ::1) and cloud metadata addresses (for example 169.254.169.254). You cannot add them to the list.
  • AurionAI always blocks the networks of the AurionAI platform itself, and cluster or cloud-internal host names. You cannot add them to the list.
  • An entry has no effect on notification webhooks, on Slack steps or on other outbound requests. These always need a public address.
  • An entry has no effect when a variable gives the host name of the URL. Write the host name or address in the URL itself.
  • When an allowed address answers with a redirect to a private address, AurionAI blocks the redirect. This is also true for a redirect to the same address or the same host name.
  • Each request that an entry allows is written to the audit log.

Entry formats

An entry is one of these:

  • a private IPv4 address, for example 10.20.0.5, or a private IPv4 network, for example 10.20.0.0/24. It must be inside 10.0.0.0/8, 172.16.0.0/12 or 192.168.0.0/16. A network must be /16 or narrower.
  • a private IPv6 address or network inside fc00::/7. A network must be /48 or narrower.
  • an exact host name, for example erp.northwind.example. A host name entry alone opens nothing. It works only together with an address or network entry that contains the addresses of the host name.

A URL with an address, for example http://10.20.0.5/, needs an address or network entry. A URL with a host name needs a host name entry and an address or network entry. AurionAI looks up the host name when the workflow runs:

  • Public addresses in the answer are allowed as usual.
  • Each private address in the answer must be inside one of your address or network entries. If one private address is not, AurionAI blocks the request.

Not accepted: wildcards (*.northwind.example), URLs, ports, public addresses, single-label host names (for example erp), and host names that end in .svc, .cluster.local, .internal, .local or .localdomain.

Add an entry

  1. In the sidebar, select Configuration.
  2. Open the System category.
  3. Select SSRF Allowlist.
  4. Select Add Entry.
  5. In Host or address, type the address, network or host name. Use one of the formats in "Entry formats" above. For a host name, also add an entry for its address or network.
  6. Optional: in Description (optional), say what the entry is for.
  7. Select Create.

SSRF Allowlist page with the form for a new entry.

Turn an entry off or delete it

  • To turn an entry off or on, select the pencil button of the entry. Its badge changes between Active and Inactive. An entry that is off allows nothing.
  • To delete an entry, select the bin button of the entry and confirm in the browser window.

Result

  • AurionAI shows Allowlist entry created or Allowlist entry deleted.
  • Changes are saved straight away. The next workflow run uses them.
  • Every new, changed or deleted entry is written to the audit log.
  • Older entries that do not use an accepted format (for example a wildcard or the start of a URL) allow nothing. Delete them and add the address again in an accepted format.

If something goes wrong

  • This entry is not accepted. Use an exact host name or a private address or network, as described under the field. The entry is not in an accepted format, or it is a loopback, cloud metadata, AurionAI platform or public address. Use one of the formats in "Entry formats" above.
  • This URL pattern already exists The entry is already in the list. Turn the existing entry on instead.
  • A workflow request to a private address is still blocked. Make sure that:
    • the entries are Active;
    • the step is a HTTP Request or Send Webhook step;
    • the URL contains the host name or address itself, not a variable;
    • for a host name, there is a host name entry and every private address of the host name is inside an address or network entry.

Still stuck? Submit a request or .