apache/shenyu · error · IllegalArgumentException

Access to sensitive ports is not allowed

Error message

Access to sensitive ports is not allowed

What it means

UrlSecurityUtils.validateHostForSSRF throws this IllegalArgumentException when the URL's port is in the sensitive-port list (well-known service ports such as 22, 3306, 6379, etc.). This blocks SSRF attempts that abuse the admin server to probe or attack local infrastructure services. The check runs after the private-IP check and before DNS resolution.

Solutions

1. Serve the target endpoint on a standard HTTP port (80/443) or a non-sensitive port.
2. If the port is legitimate for your deployment, front the service with a reverse proxy on an allowed port.
3. Review the sensitive-port list in UrlSecurityUtils to confirm which ports are blocked; do not remove entries in production.

Example fix

// before
UrlSecurityUtils.validateUrlForSSRF("http://backend.internal:3306/query");
// after
UrlSecurityUtils.validateUrlForSSRF("https://backend.example.com/query");

Set<Integer> SENSITIVE = Set.of(22, 23, 25, 3306, 6379, 8086, 9200, 27017, 9095);
int port = uri.getPort() == -1 ? defaultPort : uri.getPort();
if (SENSITIVE.contains(port)) { throw new IllegalArgumentException("sensitive port " + port); }

boolean isAllowedPort(int port) {
    return port == 80 || port == 443 || (port >= 1024 && !SENSITIVE.contains(port));
}

try {
    UrlSecurityUtils.validateUrlForSSRF(url);
} catch (IllegalArgumentException e) {
    log.warn("Port or host not allowed: {}", e.getMessage());
}

When it happens

Trigger: Calling validateUrlForSSRF with a URL whose parsed port equals a sensitive port, e.g. http://example.com:6379/ or an explicit :22/:3306/:9095 port.

Common situations: Developers configuring internal service endpoints with database or Redis ports, or testing SSRF protections by pointing URLs at local daemons on default ports.

Understand the failure class

Background: "Invalid URL" / "URL cannot be empty": fix the malformed or missing URL behind request-construction failures — this error's family across 50 libraries.

Related errors

• Access to private or internal IP addresses is not allowed
• URL cannot be empty
• Invalid URL format
• Only HTTP and HTTPS protocols are allowed
• Host cannot be empty

AI-assisted analysis of apache/shenyu@567142e072 (2026-09-12). Data as JSON: /api/errors/7f40c1f2140aab01. Report an issue: GitHub.

Appendix: source

Thrown at shenyu-admin/src/main/java/org/apache/shenyu/admin/utils/UrlSecurityUtils.java:97

        if (Objects.isNull(host) || host.trim().isEmpty()) {
            throw new IllegalArgumentException("Host cannot be empty");
        }

        String normalizedHost = host.toLowerCase().trim();

        // Check for localhost variations
        if (isLocalhost(normalizedHost)) {
            throw new IllegalArgumentException("Access to localhost is not allowed");
        }

        // Check for private IP addresses
        if (isPrivateOrInternalIP(normalizedHost)) {
            throw new IllegalArgumentException("Access to private or internal IP addresses is not allowed");
        }

        // Check for sensitive ports
        if (isSensitivePort(port)) {
            throw new IllegalArgumentException("Access to sensitive ports is not allowed");
        }

        // Additional validation for DNS resolution
        try {
            InetAddress[] addresses = InetAddress.getAllByName(normalizedHost);
            for (InetAddress address : addresses) {
                if (address.isLoopbackAddress() || address.isLinkLocalAddress()
                        || address.isSiteLocalAddress() || address.isAnyLocalAddress()) {
                    throw new IllegalArgumentException("Resolved IP address is not allowed: " + address.getHostAddress());
                }

                // Check resolved IP against private ranges
                if (isPrivateIPAddress(address.getHostAddress())) {
                    throw new IllegalArgumentException("Resolved IP address is private: " + address.getHostAddress());
                }
            }
        } catch (UnknownHostException e) {
            throw new IllegalArgumentException("Cannot resolve host: " + host);

View on GitHub (pinned to 567142e072)