{
  "topic": "errors.OIDC_SSRF_BLOCKED",
  "path": [
    "errors",
    "OIDC_SSRF_BLOCKED"
  ],
  "title": "OIDC_SSRF_BLOCKED — wellKnownConfigUri blocked by SSRF policy",
  "synopsis": "When registering an OIDC provider, cyoda validates the `wellKnownConfigUri`\nagainst a blocklist of private address ranges (loopback, RFC1918, link-local,\nIPv6 ULA). If the URI's hostname resolves to any blocked range, the\nregistration is rejected to prevent Server-Side Request Forgery attacks.",
  "body": "# errors.OIDC_SSRF_BLOCKED\n\n## NAME\n\nOIDC_SSRF_BLOCKED — the `wellKnownConfigUri` resolves to a private or link-local\naddress range that is blocked by the SSRF protection policy.\n\n## SYNOPSIS\n\nHTTP: `400` `Bad Request`. Retryable: `no`.\n\n## DESCRIPTION\n\nWhen registering an OIDC provider, cyoda validates the `wellKnownConfigUri`\nagainst a blocklist of private address ranges (loopback, RFC1918, link-local,\nIPv6 ULA). If the URI's hostname resolves to any blocked range, the\nregistration is rejected to prevent Server-Side Request Forgery attacks.\n\nBlocked ranges:\n\n- `127.0.0.0/8` — IPv4 loopback\n- `169.254.0.0/16` — IPv4 link-local (cloud metadata endpoints)\n- `10.0.0.0/8`, `172.16.0.0/12`, `192.168.0.0/16` — RFC1918 private\n- `::1/128` — IPv6 loopback\n- `fe80::/10` — IPv6 link-local\n- `fc00::/7` — IPv6 ULA\n\nIn development or controlled environments where private-network OIDC providers\nare required, set `CYODA_OIDC_ALLOW_PRIVATE_NETWORKS=true` to bypass this check.\nNever use this override in production.\n\n## SEE ALSO\n\n- errors\n- config.auth\n",
  "sections": [
    {
      "name": "NAME",
      "body": "OIDC_SSRF_BLOCKED — the `wellKnownConfigUri` resolves to a private or link-local\naddress range that is blocked by the SSRF protection policy."
    },
    {
      "name": "SYNOPSIS",
      "body": "HTTP: `400` `Bad Request`. Retryable: `no`."
    },
    {
      "name": "DESCRIPTION",
      "body": "When registering an OIDC provider, cyoda validates the `wellKnownConfigUri`\nagainst a blocklist of private address ranges (loopback, RFC1918, link-local,\nIPv6 ULA). If the URI's hostname resolves to any blocked range, the\nregistration is rejected to prevent Server-Side Request Forgery attacks.\n\nBlocked ranges:\n\n- `127.0.0.0/8` — IPv4 loopback\n- `169.254.0.0/16` — IPv4 link-local (cloud metadata endpoints)\n- `10.0.0.0/8`, `172.16.0.0/12`, `192.168.0.0/16` — RFC1918 private\n- `::1/128` — IPv6 loopback\n- `fe80::/10` — IPv6 link-local\n- `fc00::/7` — IPv6 ULA\n\nIn development or controlled environments where private-network OIDC providers\nare required, set `CYODA_OIDC_ALLOW_PRIVATE_NETWORKS=true` to bypass this check.\nNever use this override in production."
    },
    {
      "name": "SEE ALSO",
      "body": "- errors\n- config.auth"
    }
  ],
  "see_also": [
    "errors",
    "config.auth"
  ],
  "stability": "stable",
  "actions": []
}