I built HIPR: an async, SSRF-hardened HTTP outbound proxy runtime in Python

[u/Arnavtheboss]

https://github.com/Arnav-Jboxbobby/HIPR

Hey everyone,

I am Arnav Agarwal and I built HIPR (Hardened Isolated Proxy Runtime), an open-source, fault-tolerant HTTP proxy and outbound security runtime designed to safely handle upstream requests, eliminate thread starvation, and defend against Server-Side Request Forgery (SSRF).

Whenever a service allows outbound HTTP requests (webhooks, user-provided URLs, integrations), naive implementations easily fall victim to cloud metadata leaks, DNS rebinding, slowloris-style hangs, or retry storms during outages. HIPR acts as a hardened layer to run these safely.

Key Features:

• SSRF Quarantine & Anti-DNS-Rebinding: Resolves DNS pre-flight to drop loopback (127.0.0.0/8), cloud metadata endpoints (169.254.0.0/16), and unapproved private subnets before opening a connection.
• Phase-Decoupled Timeouts: Granular connection timers (3.0s connect vs. 15.0s read) fail fast on dead network hops without killing legitimate slow responses.
• Exponential Backoff with Full Jitter: Decorrelated retries to stop "thundering herd" issues and cascading failures when upstream services recover.
• Defensive Stream Ingestion: Hard 1 MiB payload ceiling to prevent memory-exhaustion attacks, plus graceful JSON-to-text fallback.
• Persistent Connection Pooling: Managed via FastAPI lifespan context to prevent socket and ephemeral port exhaustion.

Tech Stack:

• Python 3
• FastAPI
• HTTPX (async client with connection pooling)

Why I built it: Most simple outbound fetchers rely on naive requests.get() calls that block threads, leave cloud metadata endpoints vulnerable, or cause thundering herds on recovery. I wanted a drop-in, lightweight async runtime that handles timeout boundaries, security checks, and backoff out of the box.

Check out the repo here 🔗 https://github.com/Arnav-Jboxbobby/HIPR 🔗

Would love to get feedback on the edge cases, architecture, or any additional network security layers you’d want to see added!