[nicolaslem]

It's been years since I've looked into this problem but to tackle it properly one shouldn't just resolve the domain and check that the IP is acceptable. The HTTP client library needs to be involved by providing a way to run code just before creating the socket, which very few do.

[chunk_waffle]

Oh interesting... would love to hear more about that. I guess what could happen is:

You would:

1. Resolve the FQDN

2. check the IP

3. Make the request

When the request is actually made, the FQDN is resolved again and a different IP is returned?