{"version":"2.1.242","anchor":"plugin-http-calls-are-https-only-and-blocked-from-internal-a","canonical_anchor":"plugin-http-calls-are-https-only-and-blocked-from-internal-a","heading":"Plugin HTTP calls are https-only and blocked from internal addresses","tier":"soon","area":"Plugins","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.242\/e\/plugin-http-calls-are-https-only-and-blocked-from-internal-a","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.242","markdown":"### Plugin HTTP calls are https-only and blocked from internal addresses\n\nPlugin network calls are https-only and blocked from internal and metadata addresses.\n\n**What**\n\nThe plugin fetch capability refuses anything but https, refuses URLs with embedded credentials, and blocks private, loopback, link-local, carrier-NAT, multicast and reserved addresses in both IPv4 and IPv6, cloud metadata endpoints, `localhost` \/ `.local` \/ `.internal` names, and Anthropic-operated hosts. Calls time out at 30000ms. It ships as part of the plugin hook-module feature, which is off unless the server enables it.\n\n**Details**\n\n- Hostnames are resolved and the connection pinned to the resolved address; that pinning is skipped only when a proxy is configured and `CLAUDE_CODE_PROXY_RESOLVES_HOSTS` is set.\n- Redirects are capped, and a cross-origin redirect strips every header except accept, accept-language, content-type and user-agent.\n- Request and response bodies are size-capped.\n- Two policies refuse the call before any of this: sessions with nonessential network traffic disabled, and the plugin network policy check being off.\n\n**Evidence**\n\n`network access from plugins is disabled by policy`\n\n- Area: Plugins\n- Tier: Nothing to try yet\n- Useful: 3\/5\n- Signal: 4\/5\n- Present in the build but not switched on"}