BridgeSecurity and limits
What Bridge checks about your URL, the limits on endpoints and deliveries, and which headers you can and can't register.
What we check about your URL
- https is required in live. http is allowed in test, and only in test.
- No credentials in the URL and no fragment. Query strings are fine.
- Public addresses only. A URL that resolves to a loopback, link-local, private or multicast address is refused, at registration and again at every delivery.
- Redirects aren’t followed. A 3xx is a failed delivery.
- TLS certificates are always validated.
- Request bodies are capped at 256 KB; your response is read to 2 KB.
Limits
| Limit | Value |
|---|---|
| Endpoints per owner | 20 |
| Subscriptions per endpoint | 100 |
| Signing secrets active at once | 2 |
| Delivery attempts | 8 |
| Connect timeout | 5 s |
| Response timeout | 10 s |
| Maximum request body | 256 KB |
| Stored response snippet | 2 KB |
Header rules
You can register custom headers. They’re sent on every delivery, stored encrypted and returned masked. Names starting Bridge- are refused, framing headers (Host, Content-Length, Content-Type, Transfer-Encoding, Connection, Upgrade, Expect) are refused, and Authorization is refused, for the reason on the envelope page.
Not offered
- Mutual TLS. The signature is the better answer: mTLS proves the connection came from Bridge, the signature proves the bytes did, even behind a CDN that terminates TLS.
- IP allow-listing or a static source IP. The signature is the authentication.
- Queues instead of HTTP. HTTP is the sole transport. A thin HTTPS receiver that verifies and enqueues is about twenty lines.