Security Configuration Section

This section of the Product Configuration Parameters Admin Page can be used to set the following values:

Parameter

Description

Whitelisted URLs

URL prefixes that are explicitly allowed for features that fetch from user-submitted URLs, such as SPARQL SERVICE clauses and the ADS IO.http function. Each value must start with http:// or https://.

The URL whitelist

Several features fetch data from URLs that are supplied by users, including:

  • SPARQL queries that use the SERVICE keyword to query a remote endpoint

  • the ADS IO.http function

To guard against Server-Side Request Forgery (SSRF), requests made by these features are validated against an allowlist of permitted URL prefixes. A request is only carried out if the requested URL starts with one of the whitelisted prefixes. Regardless of the whitelist, all requests must use the http:// or https:// scheme.

When this parameter is left empty, whether unlisted public URLs are allowed or blocked is determined by the server’s setup-file configuration, which is managed by administrators. Access to private-network addresses is controlled in the same place and cannot be granted here. See Setup file: whitelistedURLs.

Further Reading on TopBraid