The SSRF guard validates every URL using manual per-hop redirect re-validation to block requests to private and cloud metadata IP ranges.
flowchart LR
A[Target URL] --> B[assert_public_url]
B -->|Resolves IP| C{Blocked or Private?}
C -->|Yes| D[Raise BlockedURLError]
C -->|No| E[Fetch 0-byte Range Stream]
E -->|Redirect 30x| B
E -->|Success 2xx/3xx| F[Return Response]