Package org.a2aproject.sdk.server.tasks

Interface PushNotificationUrlValidator

All Known Implementing Classes:
DefaultPushNotificationUrlValidator
public interface PushNotificationUrlValidator
Validates push notification destination URLs before outbound HTTP requests are made.

Prevents Server-Side Request Forgery (SSRF) by enforcing security policies on the client-controlled push notification URLs. The default implementation (DefaultPushNotificationUrlValidator) blocks requests to private networks, cloud metadata endpoints, and non-HTTPS URLs.

Custom implementations can be provided via CDI to adjust the policy for specific deployment environments.

See Also:

  • Field Summary

    Fields
    Modifier and Type
    Field
    Description
    static final PushNotificationUrlValidator
    ALLOW_ALL
    A validator that accepts every URL without checking.

  • Method Summary

    Modifier and Type
    Method
    Description
    void
    validate(String url)
    Validates that the given URL is safe to use as a push notification target.

  • Field Details

    • ALLOW_ALL

      static final PushNotificationUrlValidator ALLOW_ALL
      A validator that accepts every URL without checking. Intended for tests and development environments where SSRF protection is not needed.

  • Method Details

    • validate

      void validate(String url)
      Validates that the given URL is safe to use as a push notification target.
      Parameters:
      url - the push notification URL to validate
      Throws:
      IllegalArgumentException - if the URL violates the security policy