Refuse non-public destinations in http.request

[ppXD]

Summary

• http.request built its URL from trigger text or upstream model output and sent it through the default HttpClient, with no address check and auto-followed redirects. Any team member's workflow could read the worker's loopback services and cloud metadata, and a cross-origin redirect forwarded the author's X-Api-Key / PRIVATE-TOKEN / Cookie headers. The node now uses a guarded named client (GuardedHttpClientRegistration):
  • A ConnectCallback dials only public addresses, or addresses an operator commits to OutboundHttp:AllowedInternalDestinations (hosts or CIDRs). This covers every address spelling, every redirect hop and DNS rebinding.
  • The handler keeps no shared cookie jar.
  • An author-written Host header is dropped.
  • Refusals are outbound_destination_refused and fail the node as non-retryable.
• The worker's HTTP(S)_PROXY / NO_PROXY is still honoured, so proxy-only workers keep reaching public APIs. Each proxied hop's host is resolved and checked on the worker before it is sent. The proxy re-resolves the name; this window is documented in OutboundDestinationGuard and the appsettings _doc.
• Redirects are followed by OriginScopedRedirectHandler, which allows at most 10 hops and never https->http.
  • A hop that changes scheme, host or port drops every request header. This includes a same-host http->https move, so authors keep their headers by writing the https URL.
  • A redirect that would carry the request body to another origin (307/308, or 300/301/302 with any method but POST) is returned as the node's 3xx.
• The allowlist is parsed while the host is built (AddGuardedHttpClient(name, IConfiguration) in Startup), so a malformed entry stops the host instead of failing every call at run time.

Test plan

• Unit: address spellings and IPv6 forms refused with zero accepted connections. Also covered:
  • allowlist admits
  • redirect-to-loopback refused at the hop
  • headers dropped on cross-origin redirect
  • cookie isolation between runs
  • Host override ignored
  • cross-origin 307/308 with a body returned unfollowed
  • mixed DNS answer dialled only at permitted addresses (stubbed resolver, socket level)
  • public destination through a fake loopback proxy
  • internal destinations and redirects through the proxy refused before the proxy is asked
  • malformed allowlist entry fails registration
• Each new unit and integration test was mutation-checked: the behaviour removed means the test fails.
• Full unit suite: 12609 passed, 0 failed.
• Integration (real node + engine + Postgres): loopback refusals and allowlisted success. Also a public-resolving name through the operator's proxy answers in full, and a proxied metadata address fails the node with the proxy never asked. All 5 classes that run http.request: 63/63.
• E2E (WebApplicationFactory<Program>): the real host's http.request client refuses loopback (pins the Startup registration and the committed empty allowlist), and a malformed committed entry stops the host from starting. Category=E2E&Surface=Http: 165/165.
• Staging: on a worker with HTTP(S)_PROXY set, confirm a public http.request call goes through the proxy.