Struct HttpPushSender 

pub struct HttpPushSender { /* private fields */ }

HTTP-based PushSender using hyper.

Retries failed deliveries according to a configurable PushRetryPolicy.

Transport

With the tls-rustls feature (enabled by default via the a2a-protocol-sdk crate) this sender delivers over both http:// and https:// — the latter being the norm for production and what the A2A spec’s webhook field describes. Without the feature it is plaintext-HTTP only and fails fast on an https:// target with a clear, actionable error rather than a late, opaque connector failure.

You can always supply a fully custom TLS stack via RequestHandlerBuilder::with_push_sender; PushSender is a public, object-safe trait.

HTTPS and DNS-rebinding

The SSRF pre-flight (validate_webhook_url_with_dns) always runs, rejecting webhooks that resolve to private/loopback/link-local addresses. For http:// targets the validated IP is additionally pinned (the request dials the literal IP with the original Host header) to close the DNS-rebinding TOCTOU window. For https:// targets the IP is not pinned — the connection must present the original hostname for SNI and certificate verification — and the rebinding window is instead closed by TLS itself: an attacker who flips DNS to a private address after validation cannot present a certificate valid for the original hostname, so the handshake fails.

Security

• Rejects webhook URLs targeting private/loopback/link-local addresses to prevent SSRF attacks (including IPv4-in-IPv6 smuggling), and pins the validated IP against DNS-rebinding between validation and connect.
• Validates authentication credentials to prevent HTTP header injection (rejects values containing CR/LF characters).

Implementations

impl HttpPushSender

pub fn new() -> HttpPushSender

Creates a new HttpPushSender with the default 30-second request timeout and default retry policy.

pub fn with_timeout(request_timeout: Duration) -> HttpPushSender

Creates a new HttpPushSender with a custom per-request timeout.

pub fn with_tls_config(tls_config: ClientConfig) -> HttpPushSender

Creates an HttpPushSender that delivers HTTPS using a custom rustls ClientConfig instead of the default Mozilla root store.

Use this to trust an internal/private CA for webhook endpoints, or to present a client certificate for mutual TLS. Uses the default per-request timeout and retry policy (chain with_retry_policy to change them). http:// targets are still delivered in plaintext.

Requires the tls-rustls feature.

pub const fn with_dns_timeout(self, timeout: Duration) -> HttpPushSender

Bounds the SSRF pre-flight’s DNS lookup. Default: 5 seconds.

send resolves the webhook’s hostname before its first request so the resolved address can be checked against the private ranges and pinned. That lookup had no bound of its own until 0.12: a resolver that hung spent the whole push_delivery_timeout before any request was made, and timeout_outcome then reported TIMEOUT — “go and look at the endpoint” — for a resolver problem. A lookup past this bound fails the delivery with an error naming the hostname and the bound, and the bound is counted in max_delivery_duration.

pub fn with_retry_policy(self, policy: PushRetryPolicy) -> HttpPushSender

Sets a custom retry policy for push notification delivery.

pub const fn allow_private_urls(self) -> HttpPushSender

Creates an HttpPushSender that allows private/loopback URLs.

Warning: This disables SSRF protection and should only be used in testing or trusted environments.

Trait Implementations

impl Debug for HttpPushSender

fn fmt(&self, f: &mut Formatter<'_>) -> Result<(), Error>

Formats the value using the given formatter.

impl Default for HttpPushSender

fn default() -> HttpPushSender

Returns the “default value” for a type.

impl PushSender for HttpPushSender

fn max_delivery_duration(&self) -> Option<Duration>

max_attempts requests at request_timeout each, plus the backoff between them. backoff is consulted by index and falls back to its last entry, which is what the retry loop below actually does — the arithmetic here has to match that loop or the number it reports is a second thing to keep in step by hand.

fn allows_private_urls(&self) -> bool

Returns true if this sender allows webhook URLs targeting private/loopback addresses. Used by the handler to skip SSRF validation at push config creation time in testing environments.

fn send<'a>( &'a self, url: &'a str, event: &'a StreamResponse, config: &'a TaskPushNotificationConfig, ) -> Pin<Box<dyn Future<Output = Result<(), A2aError>> + Send + 'a>>

Sends a streaming event to the client’s webhook URL.