nodeTransport

@forge/monorepo / backend/src / nodeTransport

Variable: nodeTransport

const nodeTransport: SafeTransport

Defined in: backend/src/toolkit/ssrf.ts:257

The real transport: connects to a validated address with lookup pinned.

The lookup callback is what makes this sound. Node calls it at connect time instead of resolving the name, so the address that was checked is the address that is used — there is no second resolution between the check and the socket. The hostname still goes out in SNI and in the Host header, so the certificate is verified against the name the caller asked for, not against the IP.