---
id: post/demiliani-com/13588
type: post
title: "Dynamics 365 Business Central: new strict URI validation in AL Http Client"
summary: Business Central v28 introduces stricter URI validation in AL HttpClient to prevent Server-Side Request Forgery attacks by blocking HTTP requests to internal and non-routable addresses by default. Cloud environments enforce this without bypass options, while on-premises deployments offer configuration settings to whitelist trusted internal addresses when necessary.
tier: community
language: en
tags:
  - security
  - http client
  - uri validation
  - ssrf protection
  - al development
  - configuration
  - integration patterns
system: development
review:
  state: reviewed
  by: opus
  at: "2026-10-08T01:55:47.370Z"
  flags: []
generated:
  at: "2026-10-08T01:26:53.141Z"
  pipeline: 0.2.0
  prompts:
    extract-post: 1
  input_hash: 890fbb3c52fafdc7a117e3e36a86475d11e51286c5d8c6196f1063963fb8c12d
evidence:
  - kind: blog
    url: https://demiliani.com/2026/04/02/dynamics-365-business-central-new-strict-uri-validation-in-al-http-client/
    title: "Dynamics 365 Business Central: new strict URI validation in AL Http Client"
    date: "2026-04-02"
    commit: null
    t: null
    quote: null
  - kind: blog
    url: https://demiliani.com/2026/04/02/dynamics-365-business-central-new-strict-uri-validation-in-al-http-client/
    title: "Dynamics 365 Business Central: new strict URI validation in AL Http Client"
    date: "2026-04-02"
    commit: null
    t: null
    quote: Starting with Business Central v28, outgoing HTTP calls made through the AL HttpClient are subject to hardened URI validation.
  - kind: blog
    url: https://demiliani.com/2026/04/02/dynamics-365-business-central-new-strict-uri-validation-in-al-http-client/
    title: "Dynamics 365 Business Central: new strict URI validation in AL Http Client"
    date: "2026-04-02"
    commit: null
    t: null
    quote: For organizations using Business Central online, there is no way to bypass this security restriction. This is intentional and non-negotiable.
links:
  learn: []
  objects: []
  features: []
  topics: []
  localizations: []
  videos: []
  posts: []
  guidelines: []
post_id: "13588"
source_id: demiliani-com
source_name: Stefano Demiliani
url: https://demiliani.com/2026/04/02/dynamics-365-business-central-new-strict-uri-validation-in-al-http-client/
published_at: "2026-04-02T07:16:44.000Z"
author: Stefano Demiliani
full_text: false
words: 986
quotes:
  - text: Starting with Business Central v28, outgoing HTTP calls made through the AL HttpClient are subject to hardened URI validation.
    why_it_matters: This is the core change developers need to understand and plan for when upgrading their extensions
  - text: For organizations using Business Central online, there is no way to bypass this security restriction. This is intentional and non-negotiable.
    why_it_matters: Cloud customers must understand they cannot disable the protection, making extension refactoring mandatory for internal integrations
code_objects_mentioned:
  - other HttpClient
systems:
  - development
  - integration
  - platform
versions_mentioned:
  - "28"
  - 26.x
  - 27.x
  - 2026 Wave 1
preview:
  embeddable: true
  frame_url: https://demiliani.com/2026/04/02/dynamics-365-business-central-new-strict-uri-validation-in-al-http-client/embed/
  image: https://demiliani.com/wp-content/uploads/2026/04/bcssfrattack_01.png
  image_alt: null
  image_w: 927
  image_h: 353
  site_name: Stefano Demiliani
  favicon: https://demiliani.com/wp-content/uploads/2022/09/sd_wordpress_logo.png?w=32
  probed_at: "2026-10-07T11:50:49.526Z"
---

# Dynamics 365 Business Central: new strict URI validation in AL Http Client

[Read the post](https://demiliani.com/2026/04/02/dynamics-365-business-central-new-strict-uri-validation-in-al-http-client/) · Stefano Demiliani (Stefano Demiliani, MVP) · 2026-04-02 · 986 words · tier community · reviewed (checked by Opus)

> Business Central v28 introduces stricter URI validation in AL HttpClient to prevent Server-Side Request Forgery attacks by blocking HTTP requests to internal and non-routable addresses by default. Cloud environments enforce this without bypass options, while on-premises deployments offer configuration settings to whitelist trusted internal addresses when necessary.

## Key points

- Strict URI validation blocks HTTP requests to localhost, private IP ranges, link-local addresses, and other non-public network addresses
- SSRF protection is mandatory in cloud/SaaS environments with no bypass options available
- On-premises deployments can use NavHttpClientAntiSSRFEnabled and NavHttpClientAntiSSRFAllowedAddresses settings to manage restrictions
- Security enhancement is backported to versions 26.x and 27.x for consistent protection across supported versions
- Extensions relying on internal integrations may need refactoring to use public APIs, Logic Apps, or other managed integration solutions

## Quotes

- "Starting with Business Central v28, outgoing HTTP calls made through the AL HttpClient are subject to hardened URI validation." (This is the core change developers need to understand and plan for when upgrading their extensions)
- "For organizations using Business Central online, there is no way to bypass this security restriction. This is intentional and non-negotiable." (Cloud customers must understand they cannot disable the protection, making extension refactoring mandatory for internal integrations)

## AL objects mentioned

As named in the post. A name that matches one object page by exact type and name links to it; the others stay as named.

- other "HttpClient"

## Context

- Features: Strict URI validation, SSRF attack prevention, NavHttpClientAntiSSRFEnabled configuration, NavHttpClientAntiSSRFAllowedAddresses configuration, Internal address blocking, URI whitelist support
- Versions: 28, 26.x, 27.x, 2026 Wave 1

Source: Stefano Demiliani, community blog. Summary, key points and quotes are derived (CONTENT-NOTICE.md); read the original for the full text.