BC Observatoryunofficial, made by waldo
community postAL Developmentcommunity - not Microsoftreviewed - checked by Opus

Dynamics 365 Business Central: new strict URI validation in AL Http Client

Business Central v28 introduces stricter URI validation in AL HttpClient to prevent Server-Side Request Forgery attacks by blocking HTTP requests to internal and non-routable addresses by default. Cloud environments enforce this without bypass options, while on-premises deployments offer configuration settings to whitelist trusted internal addresses when necessary.

Open in Claude13588.md

post Stefano Demiliani

Stefano Demiliani · 2026-04-02 · 986 words · about 4 min

"Starting with Business Central v28, outgoing HTTP calls made through the AL HttpClient are subject to hardened URI validation."
Show the post hereRead on Stefano Demiliani

Key points

  • Strict URI validation blocks HTTP requests to localhost, private IP ranges, link-local addresses, and other non-public network addresses
  • SSRF protection is mandatory in cloud/SaaS environments with no bypass options available
  • On-premises deployments can use NavHttpClientAntiSSRFEnabled and NavHttpClientAntiSSRFAllowedAddresses settings to manage restrictions
  • Security enhancement is backported to versions 26.x and 27.x for consistent protection across supported versions
  • Extensions relying on internal integrations may need refactoring to use public APIs, Logic Apps, or other managed integration solutions

Quotes

  • “Starting with Business Central v28, outgoing HTTP calls made through the AL HttpClient are subject to hardened URI validation.” (This is the core change developers need to understand and plan for when upgrading their extensions)
  • “For organizations using Business Central online, there is no way to bypass this security restriction. This is intentional and non-negotiable.” (Cloud customers must understand they cannot disable the protection, making extension refactoring mandatory for internal integrations)

AL objects mentioned

As named in the post. A name that matches one object page by exact type and name links to it; the others stay as named.

  • other “HttpClient”

Context

  • Features: Strict URI validation, SSRF attack prevention, NavHttpClientAntiSSRFEnabled configuration, NavHttpClientAntiSSRFAllowedAddresses configuration, Internal address blocking, URI whitelist support
  • Versions: 28, 26.x, 27.x, 2026 Wave 1

Source: Stefano Demiliani, community blog. Summary, key points and quotes are derived (CONTENT-NOTICE.md); read the original for the full text.