{"record":{"id":"4700a2f109a179be","repo":"kestra-io/kestra","slug":"the-uri-is-in-the-configured-denied-list-kestr","errorCode":null,"errorMessage":"The URI {} is in the configured denied list (kestra.tasks.http.denied-list).","messagePattern":"The URI (.+?) is in the configured denied list \\(kestra\\.tasks\\.http\\.denied-list\\)\\.","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"core/src/main/java/io/kestra/core/http/client/HttpClient.java","lineNumber":564,"sourceCode":"        }\n    }\n\n    @SuppressWarnings(\"unchecked\")\n    private void validateUri(URI uri) {\n        String requestUri = uri.toString();\n        List<String> allowedList = (List<String>) ((DefaultRunContext) runContext).getTaskProperty(\"kestra.tasks.http.allowed-list\", List.class).orElse(Collections.emptyList());\n        List<String> deniedList = (List<String>) ((DefaultRunContext) runContext).getTaskProperty(\"kestra.tasks.http.denied-list\", List.class).orElse(Collections.emptyList());\n\n        // first check that if there is an allow list, it matches one\n        if (!allowedList.isEmpty()) {\n            if (allowedList.stream().noneMatch(requestUri::startsWith)) {\n                throw new IllegalArgumentException(\"The URI \" +  requestUri + \" is not in the configured allowed list (kestra.tasks.http.allowed-list).\");\n            }\n        }\n\n        // then check that there are no exclusion for it\n        if (deniedList.stream().anyMatch(requestUri::startsWith)) {\n            throw new IllegalArgumentException(\"The URI \" +  requestUri + \" is in the configured denied list (kestra.tasks.http.denied-list).\");\n        }\n    }\n\n    @SuppressWarnings(\"unchecked\")\n    private <T> T bodyHandler(Class<?> cls, HttpEntity entity) throws IOException, ParseException {\n        if (entity == null) {\n            return null;\n        } else if (String.class.isAssignableFrom(cls)) {\n            return (T) EntityUtils.toString(entity);\n        } else if (Byte[].class.isAssignableFrom(cls)) {\n            return (T) ArrayUtils.toObject(EntityUtils.toByteArray(entity));\n        } else if (MediaType.APPLICATION_YAML.equals(entity.getContentType()) || \"application/yaml\".equals(entity.getContentType())) {\n            return (T) JacksonMapper.ofYaml().readValue(entity.getContent(), cls);\n        } else {\n            return (T) JacksonMapper.ofJson(false).readValue(entity.getContent(), cls);\n        }\n    }\n","sourceCodeStart":546,"sourceCodeEnd":582,"githubUrl":"https://github.com/kestra-io/kestra/blob/823fada9274c4f9c251ea0a516460a4f7d958032/core/src/main/java/io/kestra/core/http/client/HttpClient.java#L546-L582","documentation":"Thrown by the Kestra HTTP client when a denied-list is configured (kestra.tasks.http.denied-list) and the request URI starts with a denied prefix. validateUri runs after the allow-list check; if deniedList.stream().anyMatch(requestUri::startsWith), it throws IllegalArgumentException naming the URI. This blocks requests to forbidden hosts (SSRF / internal-network protection).","triggerScenarios":"Task property kestra.tasks.http.denied-list is configured (possibly empty); request URI starts with one of the denied prefixes; the anyMatch branch throws IllegalArgumentException.","commonSituations":"The denied-list covers internal ranges (e.g. http://localhost, http://169.254.169.254) and the task targets one, a dynamic URI resolved to a blocked host, or the denied-list was broadened and now catches a legitimate target.","solutions":["Retarget the task to a host not on the denied-list.","If the denial is too broad, narrow the denied prefix or remove the offending entry (with security approval).","Constrain dynamic URI expressions so they cannot resolve to blocked hosts.","Prefer the allow-list model for stricter control instead of maintaining a deny-list."],"exampleFix":"# before\ntask uri: \"http://169.254.169.254/latest/meta-data\" # denied\n# after\ntask uri: \"https://api.example.com/metadata\"         # allowed","handlingStrategy":"validation","validationCode":"List<String> denied = getTaskProperty('kestra.tasks.http.denied-list', List.class).orElse(List.of());\nif (denied.stream().anyMatch(uri.toString()::startsWith)) {\n  throw new IllegalStateException('URI is denied: ' + uri);\n}","typeGuard":null,"tryCatchPattern":"try {\n  validateUri(uri);\n} catch (IllegalArgumentException e) {\n  if (e.getMessage().contains('denied list')) {\n    log.warn('Denied-list blocked {}', uri);\n  }\n  throw e;\n}","preventionTips":["Keep the denied-list covering internal/link-local ranges.","Constrain dynamic URIs away from blocked hosts.","Prefer allow-listing for stricter control where feasible."],"tags":["http-client","security","ssrf","deny-list","configuration"],"backgroundTag":null,"analyzedSha":"823fada9274c4f9c251ea0a516460a4f7d958032","analyzedAt":"2026-08-14T06:15:17.947Z","schemaVersion":2},"datasetVersion":"2026-08-14T10:17:34.591Z"}