HttpFetcher (doorkeeper/http_fetcher.rb)

Fetches JSON documents over HTTPS with SSRF hardening for OAuth/JWKS verification

# Source: https://github.com/doorkeeper-gem/doorkeeper | License: MIT
# Provided via justclaw.it.com; keep this notice with the code.
# frozen_string_literal: true

require "ipaddr"
require "net/http"
require "resolv"
require "uri"

module Doorkeeper
  # Fetches a small operator-untrusted JSON document — a client's jwks_uri
  # today — over HTTPS: redirects are never followed and any status other
  # than 200 OK is an error.
  #
  # SSRF hardening: the host is resolved up front and the request is refused
  # when any resolved address falls into an RFC 6890 special-use range
  # (loopback, private-use, link-local, ...). The connection is then pinned
  # to a vetted address via Net::HTTP#ipaddr= so a second, post-check DNS
  # resolution (DNS rebinding) cannot redirect the request; TLS is st

... (truncated -- full source via MCP)