# Safely performing external HTTP requests (avoiding SSRF) **URL:** \ **Category:** Questions\ **Tags:** http, finch, req\ **Created:** [September 21, 2025, 5:41pm UTC](https://forum.elixirforum.com/t/safely-performing-external-http-requests-avoiding-ssrf/72598 "2025-09-21T17:41:03Z")\ **Posts on this page:** 1\ **Showing post:** 3
**Author:** ![garrison](https://forum.elixirforum.com/letter_avatar_proxy/v4/letter/g/3bc359/32.png) [@garrison](https://forum.elixirforum.com/u/garrison)\ **Post date:** [September 22, 2025, 4:45pm UTC](https://forum.elixirforum.com/t/safely-performing-external-http-requests-avoiding-ssrf/72598/3 "2025-09-22T16:45:41Z")
A blame shows that the option was [added in this PR](https://github.com/elixir-mint/mint/pull/283) which adds support for connecting to IPs (and sockets). The `hostname` is actually _required_ when connecting to an IP. (Actually, what are you supposed to do if you’re _really_ connecting to an IP, pass it in as a string?) The docs claim the `hostname` value is used for the `Host` header and for HTTPS: to validate the cert and also for SNI (to request the right cert). It also says “and so on”, whatever that means lol. This is all fine and good; it’s exactly what I want to do. Resolve the domain myself and then connect to the IP directly (to avoid malicious DNS replies) while preserving the original host for HTTPS. The problem is that as far as I can tell Finch (and therefore Req) provides no way to pass this value in. Apparently it can be passed in with `conn_opts` when creating the pool, but I want to pass it in when making the request. I have a very poor understanding of how Finch’s pools actually work so maybe there actually is some way to do this? But it’s certainly not _obvious_, and this is a serious security issue for which we need to provide a solution and clear guidance. > [@LostKobrakai](#): > > On newer OTP versions it might be safe to manually set the Host header and use the IP on the address. Are you suggesting the `Host` header will be used for HTTPS by Mint when connecting to an IP? I haven’t found anything to this effect in the docs or code but I also didn’t try it either. As far as I can tell the code you linked is related to Mint [verifying cert hostnames itself](https://github.com/elixir-mint/mint/pull/261) because they don’t like the OTP behavior or it was not previously available (not immediately clear to me). --- _[View the full topic](https://forum.elixirforum.com/t/safely-performing-external-http-requests-avoiding-ssrf/72598)._