improvement(network): reuse validated HTTP transports

Author: waleedlatif1

apps/docs/content/docs/platform/self-hosting/environment-variables.mdx

@@ -119,6 +119,8 @@ import { Callout } from 'fumadocs-ui/components/callout'
 | `LITELLM_BASE_URL` | LiteLLM proxy base URL |
 | `LITELLM_API_KEY` | Optional bearer token for LiteLLM |
 
+On self-hosted deployments, the hosts configured in `OLLAMA_URL`, `VLLM_BASE_URL`, `LITELLM_BASE_URL`, `AZURE_OPENAI_ENDPOINT`, `AZURE_ANTHROPIC_ENDPOINT`, and `OCR_AZURE_ENDPOINT` can be reached on private networks without adding them to `EGRESS_ALLOWED_HOSTS`. Existing allowlists still apply. See [model host permissions](/platform/self-hosting/security#the-ssrf-boundary) for which requests this permits.
+
 ## Login Providers
 
 Google, GitHub, and Microsoft sign-in, their callback URLs, and the `DISABLE_*_AUTH` switches are documented in [Authentication](/platform/self-hosting/authentication#social-login).

apps/docs/content/docs/platform/self-hosting/networking.mdx

@@ -302,33 +302,28 @@ A proxy body limit of 250 MB accommodates all three defaults. If you lower the a
 
 ## Outbound connectivity
 
-The app makes outbound calls to model providers, integration APIs, your email provider, object storage, and your telemetry backend. Whether `HTTP_PROXY` / `HTTPS_PROXY` apply depends on which of those paths a call takes — there is no single answer, and no global setting that covers all of them.
+The shared HTTP transport honors `HTTP_PROXY`, `HTTPS_PROXY`, and `NO_PROXY` on both Bun and Node. This covers guarded HTTP requests, model-provider clients using Sim's fetch adapter, and AWS clients using Sim's shared request handler. It does not configure a global dispatcher or route non-HTTP protocols.
 
-The server runs on Bun, and Bun's native `fetch` honors `$HTTP_PROXY`, `$HTTPS_PROXY`, and `$NO_PROXY`. Sim installs no global dispatcher, so every call that goes through the default `fetch` is proxied. The rest either build their own HTTP agent or speak a non-HTTP protocol.
+Use an `http://` or `https://` proxy URL. For proxy authentication, both the username and password must be nonempty; partial credentials are refused. Lowercase variables take precedence over uppercase ones. `HTTP_PROXY` also applies to HTTPS when `HTTPS_PROXY` is unset. `NO_PROXY` matches the original destination hostname, with optional ports; it accepts exact names, domain suffixes, and `*`, but not CIDR ranges.
 
-<Callout type="warn">
-  This depends on the runtime. The published images run Bun. If you build the standalone output and run it under Node instead, Node ignores these variables unless started with `NODE_USE_ENV_PROXY=1` (Node 22.21+ / 24.5+), and the `fetch`-based "Yes" rows stop being proxied — model providers, Resend, Gmail sending, the desktop update feed, and the telemetry relay. The Azure Blob, GCS and Azure Communication Services rows still hold: those SDKs read the proxy variables through their own agents rather than through `fetch`.
-</Callout>
+The transport resolves and validates destinations locally, then sends the approved numeric IP address in a CONNECT request. The original hostname remains in the HTTP Host header and TLS certificate verification. Both HTTP and HTTPS destinations require a proxy that accepts numeric CONNECT authorities. Proxy tunnels use HTTP/1.1; direct connections, including `NO_PROXY` matches, retain each client's HTTP/2 configuration. A proxy that requires hostname-only CONNECT or resolves names unavailable to the application cannot be used by this transport. Use NAT or transparent egress for those environments. Proxy failures never fall back to a direct connection.
+
+An environment proxy is trusted deployment configuration, so its own address can be private or loopback. Its DNS answers are checked and pinned before connecting, and cloud metadata addresses are always refused. This trust does not change destination permissions: content URLs remain public-only, while configured private services still need the applicable [egress allowance](/platform/self-hosting/security#the-ssrf-boundary).
 
 | Outbound path | Honors `HTTP_PROXY` / `HTTPS_PROXY` |
 |---|---|
-| Model providers reached over the default `fetch` — Anthropic, OpenAI, Google/Gemini, Vertex, Groq, Cerebras, xAI, Mistral, DeepSeek, OpenRouter, Together, Fireworks, Ollama, LiteLLM, and the other OpenAI-compatible providers | Yes |
-| Email via Resend, Azure Communication Services, and Gmail sending | Yes |
-| The desktop update feed's calls to GitHub | Yes |
-| Object storage — Azure Blob and GCS | Yes — their SDK pipelines read the proxy variables |
-| Everything through the SSRF guard — the HTTP block, tools, connectors, outbound webhooks, content fetches, MCP servers | No |
-| Azure OpenAI, Azure Anthropic, vLLM | Only when the endpoint comes from `AZURE_OPENAI_ENDPOINT`, `AZURE_ANTHROPIC_ENDPOINT`, or `VLLM_BASE_URL`. An endpoint typed into the block is validated and pinned to its resolved IP, which bypasses the proxy |
-| Amazon Bedrock, and object storage on S3 | No — the AWS SDK uses its own request handler |
-| Email via SMTP | No — Nodemailer opens a raw TCP connection |
-| Email via Amazon SES | No — the AWS SDK transport, over HTTPS |
+| Shared guarded HTTP transport: tools, connectors, outbound webhooks, content fetches, MCP HTTP connections, and model-provider clients using Sim's fetch adapter | Yes, on Bun and Node, subject to the CONNECT requirements above |
+| Amazon Bedrock and AWS integration clients using Sim's shared request handler | Yes, on Bun and Node |
+| Object storage on Azure Blob and GCS; Azure Communication Services email | Yes, through the SDK's own proxy support |
+| Native `fetch` paths and SDKs that use it, including Resend email, the desktop update feed, and the `/api/telemetry` relay | Yes on Bun; Node requires [`NODE_USE_ENV_PROXY=1`](https://nodejs.org/api/cli.html#node_use_env_proxy1) (Node 22.21+ / 24.0+) |
+| Application object storage on S3; application email via Amazon SES | No, these clients use their own AWS SDK transport |
+| Email via SMTP, Postgres, and Redis | No, these use raw TCP |
 | OTLP export from the server SDK | No |
-| The `/api/telemetry` relay that forwards browser events | Yes — it uses the default `fetch` |
-| Postgres and Redis | No — raw TCP |
 
-The practical consequence: a mandatory-egress-proxy environment can route most LLM traffic, Resend mail, and Azure/GCS storage through the proxy, but guarded integration calls, S3, Bedrock, SMTP, telemetry, and datastore traffic still need a transparent proxy or NAT-based egress.
+An assigned organization gateway takes precedence over environment proxy settings. An explicit HTTP-block `proxyUrl` takes precedence over environment settings on direct routes, and is refused when organization policy requires a gateway.
 
 <Callout type="info">
-  Set `NO_PROXY` for every destination that is not on the public internet, not just model endpoints. The app reaches the realtime server (`SOCKET_SERVER_URL`), the Presidio PII service (`PII_URL`), and itself (`INTERNAL_API_BASE_URL`) over the same default `fetch`, alongside self-hosted Ollama, LiteLLM, and vLLM — so a proxy that cannot reach your internal network breaks live updates and PII redaction, not only inference.
+  Set `NO_PROXY` for every destination that is not on the public internet, not just model endpoints. The app reaches the realtime server (`SOCKET_SERVER_URL`), the Presidio PII service (`PII_URL`), and itself (`INTERNAL_API_BASE_URL`) over HTTP, alongside self-hosted Ollama, LiteLLM, and vLLM — so a proxy that cannot reach your internal network breaks live updates and PII redaction, not only inference.
 
   Set it in the application environment, not your shell — under `app.env` on Helm, or the service's `environment:` on Compose. On Helm the suffixes alone are not enough: the chart wires `SOCKET_SERVER_URL`, `PII_URL`, and `OLLAMA_URL` to bare Service names, which no domain suffix matches. Add those names too — `helm template` prints the rendered ones, and the prefix is the release name unless it already contains `sim`, in which case it is the release name alone:
 
@@ -349,9 +344,9 @@ The practical consequence: a mandatory-egress-proxy environment can route most L
   ```
 </Callout>
 
-### The per-request escape hatch
+### Per-request proxies
 
-The HTTP block's `proxyUrl` is honored per request by the SSRF guard, which builds a proxy agent for that call instead of pinning the target IP. It applies only to that path — connectors, content fetches, and MCP calls take a different guarded transport with no per-request proxy option.
+The HTTP block's `proxyUrl` builds a proxy agent for that request. It applies only to the HTTP block; connectors, content fetches, and MCP calls use deployment proxy settings. This per-request path validates the destination locally but lets the proxy resolve the destination hostname, unlike the numeric CONNECT used by environment proxies.
 
 <Callout type="warn">
   `proxyUrl` must be an `http://` URL **and** must resolve to a public address. The guard validates the proxy host under a dedicated `proxy` profile that has no operator allowlist, so `EGRESS_ALLOWED_HOSTS` and `EGRESS_ALLOWED_IP_RANGES` do not reach it. A corporate proxy on an RFC 1918 address is refused even when that range is allowlisted for everything else. See [Security](/platform/self-hosting/security#the-ssrf-boundary).

apps/docs/content/docs/platform/self-hosting/security.mdx

@@ -172,7 +172,7 @@ Resource ceilings for the in-process path:
 
 ## The SSRF boundary
 
-By default Sim blocks outbound requests to private, reserved, and loopback addresses. This stops a workflow from being used to scan your internal network. Two things soften it on a self-hosted deployment: the provenances marked **Yes** below reach whatever you allowlist, and a configured endpoint, self-hosted service, or request target written as `localhost` or a loopback literal is reachable without any allowlist at all — a local Ollama or Jupyter is the ordinary case. That second carve-out stops short in two places: it does not lift the blocked-port list, and it does not extend to a database, cache, or mail connector on `localhost` — loopback is where Sim's own database and Redis listen, so reaching them has to be asked for. Neither softening applies on Sim Cloud. Every outbound request is classified by where its URL came from:
+By default Sim blocks outbound requests to private, reserved, and loopback addresses. The allowances below let a self-hosted deployment reach services its operator has configured. The provenances marked **Yes** reach whatever you allowlist. A configured endpoint, self-hosted service, or request target written as `localhost` or a loopback literal is also reachable without an allowlist. That loopback allowance does not lift the blocked-port list or apply to database, cache, and mail connectors. These allowances do not apply on Sim Cloud. Every outbound request is classified by where its URL came from:
 
 | Provenance | Examples | Reaches allowlisted private destinations |
 |---|---|---|
@@ -181,9 +181,11 @@ By default Sim blocks outbound requests to private, reserved, and loopback addre
 | Request target | The HTTP block's URL, an A2A agent, an RSS feed, a Function block's `fetch` | Yes |
 | Database host | A database, cache, or mail connector's host | Yes |
 | Content fetch | An image URL, a file imported by URL, a link from a third-party API response | **No** |
-| Proxy | The outbound HTTP proxy itself | **No** |
+| Per-request proxy | The HTTP block's `proxyUrl` | **No** |
 
-Content fetches never reach a private destination, allowlist or not — that is the class where SSRF is actually exploited. Nor does the proxy: it is the component deciding where everything else may go, so it is held to public destinations regardless of what the allowlist says.
+The hosts in `OLLAMA_URL`, `VLLM_BASE_URL`, and `LITELLM_BASE_URL` are also trusted for self-hosted services. The hosts in `AZURE_OPENAI_ENDPOINT`, `AZURE_ANTHROPIC_ENDPOINT`, and `OCR_AZURE_ENDPOINT` are trusted for configured endpoints. These must be HTTP or HTTPS URLs without embedded credentials or wildcard hostnames. This trust covers the exact host or IP address across ports, without replacing your existing allowlists. It does not grant access through an HTTP block, a Function block's `fetch`, or a URL taken from content. Cloud metadata endpoints remain blocked, and model URL settings grant no private-network access on Sim Cloud.
+
+Content fetches never reach a private destination, allowlist or not — that is the class where SSRF is actually exploited. The HTTP block's per-request proxy must also resolve to a public address regardless of the allowlist. Deployment proxies configured through `HTTP_PROXY` or `HTTPS_PROXY` can use private or loopback addresses; their DNS answers are checked and pinned, and metadata endpoints remain blocked. They do not expand which destinations a request may reach. See [Outbound connectivity](/platform/self-hosting/networking#outbound-connectivity).
 
 Deployments frequently need to reach an internal service by name or address. Name the destinations:
 

apps/sim/app/api/cron/renew-subscriptions/route.test.ts

@@ -39,7 +39,9 @@ vi.mock('@/lib/core/network/config.server', () => ({
 vi.mock('@/lib/workspaces/application/workspace-context', () => ({
   loadActiveWorkspaceApplicationContext: mocks.workspace,
 }))
-vi.mock('@/lib/core/security/input-validation.server', () => ({ outboundFetch: mocks.fetch }))
+vi.mock('@/lib/core/security/input-validation.server', () => ({
+  secureFetchWithValidation: mocks.fetch,
+}))
 vi.mock('@/lib/webhooks/provider-subscription-utils', () => ({
   getCredentialOwner: mocks.credentialOwner,
   getNotificationUrl: () => 'https://example.com/api/webhooks/trigger/teams',

apps/sim/app/api/cron/renew-subscriptions/route.ts

@@ -2,12 +2,13 @@ import { db } from '@sim/db'
 import { webhook as webhookTable, workflow } from '@sim/db/schema'
 import { createLogger } from '@sim/logger'
 import { generateShortId } from '@sim/utils/id'
+import { isRecordLike } from '@sim/utils/object'
 import { and, eq, or } from 'drizzle-orm'
 import { type NextRequest, NextResponse } from 'next/server'
 import { verifyCronAuth } from '@/lib/auth/internal'
 import { acquireLock, releaseLock } from '@/lib/core/config/redis'
 import { withResourceOutboundScope } from '@/lib/core/network/resource-scope.server'
-import { outboundFetch } from '@/lib/core/security/input-validation.server'
+import { secureFetchWithValidation } from '@/lib/core/security/input-validation.server'
 import { runDetached } from '@/lib/core/utils/background'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
 import { refreshAccessTokenIfNeeded } from '@/lib/oauth/credential-service'
@@ -44,7 +45,9 @@ async function recreateSubscription(
   const notificationUrl = getNotificationUrl(webhook)
   const expirationDateTime = new Date(Date.now() + MAX_LIFETIME_MINUTES * 60 * 1000).toISOString()
 
-  const res = await outboundFetch('https://graph.microsoft.com/v1.0/subscriptions', {
+  const res = await secureFetchWithValidation('https://graph.microsoft.com/v1.0/subscriptions', {
+    profile: 'configuredEndpoint',
+    redirectPolicy: { mode: 'standard', sendCredentialsOnCrossOriginRedirect: false },
     method: 'POST',
     headers: {
       Authorization: `Bearer ${accessToken}`,
@@ -65,13 +68,20 @@ async function recreateSubscription(
     const error = await res.json()
     logger.error(`Failed to recreate Teams subscription for webhook ${webhook.id}`, {
       status: res.status,
-      error: error.error,
+      error: isRecordLike(error) ? error.error : undefined,
     })
     return null
   }
 
   const payload = await res.json()
-  return { id: payload.id as string, expirationDateTime: payload.expirationDateTime as string }
+  if (
+    !isRecordLike(payload) ||
+    typeof payload.id !== 'string' ||
+    typeof payload.expirationDateTime !== 'string'
+  ) {
+    throw new Error('Invalid Teams subscription response')
+  }
+  return { id: payload.id, expirationDateTime: payload.expirationDateTime }
 }
 
 /**
@@ -168,9 +178,11 @@ async function renewExpiringSubscriptions(): Promise<{
           Date.now() + MAX_LIFETIME_MINUTES * 60 * 1000
         ).toISOString()
 
-        const res = await outboundFetch(
+        const res = await secureFetchWithValidation(
           `https://graph.microsoft.com/v1.0/subscriptions/${externalSubscriptionId}`,
           {
+            profile: 'configuredEndpoint',
+            redirectPolicy: { mode: 'standard', sendCredentialsOnCrossOriginRedirect: false },
             method: 'PATCH',
             headers: {
               Authorization: `Bearer ${accessToken}`,
@@ -187,7 +199,7 @@ async function renewExpiringSubscriptions(): Promise<{
           const error = await res.json()
           logger.error(
             `Failed to renew Teams subscription ${externalSubscriptionId} for webhook ${webhook.id}`,
-            { status: res.status, error: error.error }
+            { status: res.status, error: isRecordLike(error) ? error.error : undefined }
           )
 
           if (res.status === 404 || res.status === 410) {
@@ -207,7 +219,10 @@ async function renewExpiringSubscriptions(): Promise<{
           }
         } else {
           const payload = await res.json()
-          newExpiration = payload.expirationDateTime as string
+          if (!isRecordLike(payload) || typeof payload.expirationDateTime !== 'string') {
+            throw new Error('Invalid Teams subscription response')
+          }
+          newExpiration = payload.expirationDateTime
         }
 
         const updatedConfig = {

apps/sim/app/api/providers/openrouter/embeddings/models/route.test.ts

@@ -1,7 +1,7 @@
 /**
  * @vitest-environment node
  */
-import { createMockRequest } from '@sim/testing'
+import { createMockRequest, inputValidationMock } from '@sim/testing'
 import { afterAll, beforeEach, describe, expect, it, vi } from 'vitest'
 
 const { mockFetch, mockFilterBlacklistedModels, mockIsProviderBlacklisted } = vi.hoisted(() => ({
@@ -10,6 +10,11 @@ const { mockFetch, mockFilterBlacklistedModels, mockIsProviderBlacklisted } = vi
   mockIsProviderBlacklisted: vi.fn(),
 }))
 
+vi.mock('@/lib/core/security/input-validation.server', () => ({
+  ...inputValidationMock,
+  secureFetchWithValidation: mockFetch,
+}))
+
 vi.mock('@/providers/utils', () => ({
   filterBlacklistedModels: mockFilterBlacklistedModels,
   isProviderBlacklisted: mockIsProviderBlacklisted,
@@ -18,17 +23,19 @@ vi.mock('@/providers/utils', () => ({
 import { GET } from '@/app/api/providers/openrouter/embeddings/models/route'
 
 const request = () => createMockRequest('GET')
+let clock = 0
 
 describe('GET /api/providers/openrouter/embeddings/models', () => {
   beforeEach(() => {
     vi.clearAllMocks()
-    vi.stubGlobal('fetch', mockFetch)
+    clock += 300_001
+    vi.spyOn(performance, 'now').mockImplementation(() => clock)
     mockIsProviderBlacklisted.mockReturnValue(false)
     mockFilterBlacklistedModels.mockImplementation((models: string[]) => models)
   })
 
   afterAll(() => {
-    vi.unstubAllGlobals()
+    vi.restoreAllMocks()
   })
 
   it('returns every unique embedding model with the OpenRouter prefix', async () => {
@@ -50,7 +57,7 @@ describe('GET /api/providers/openrouter/embeddings/models', () => {
     })
     expect(mockFetch).toHaveBeenCalledWith(
       'https://openrouter.ai/api/v1/embeddings/models',
-      expect.objectContaining({ next: { revalidate: 300 } })
+      expect.objectContaining({ profile: 'configuredEndpoint', maxResponseBytes: 4 * 1024 * 1024 })
     )
   })
 

apps/sim/connectors/asana/asana.test.ts

@@ -1,6 +1,10 @@
 /**
  * @vitest-environment node
  */
+import { inputValidationMock } from '@sim/testing'
+
+vi.mock('@/lib/core/security/input-validation.server', () => inputValidationMock)
+
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import {
   asanaConnector,

apps/sim/connectors/ashby/ashby.test.ts

@@ -1,6 +1,10 @@
 /**
  * @vitest-environment node
  */
+import { inputValidationMock } from '@sim/testing'
+
+vi.mock('@/lib/core/security/input-validation.server', () => inputValidationMock)
+
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 import { ashbyConnector } from '@/connectors/ashby/ashby'
 import { ashbyConnectorMeta } from '@/connectors/ashby/meta'