Merge commit from fork

* Inject DenyList from config to `StartCommands()`

* Implementation draft

* Move address checker to separate package

* Migrate usages of actions.AddressChecker to denylist.AddressChecker

* Rename denylist package files

* Pass []denylist.AddressChecker to StartCommand

* Add DenyList to defaults.yaml and add custom config parser

* net: add HostnameToIPList function

* denylist: Add IsHostBlocked()

* actions: use denylist.IsHostBlocked()

* command: Inject ip lookup function + extend add target validationt test

* command: Unexport ChangeTarget.IsValid()

* command: Add denyList check on ChangeTarget validation

* command: Export ActionsV2DenyList and IPLookupFunction params

* Lint fix

* Check denylist during action execution

* Fix integration tests

* Apply suggestions

* Add `mapstructure.StringToSliceHookFunc()` to decode `HTTPConfigDecodeHook`

internal/api/api.go

@@ -26,6 +26,7 @@ import (
 	http_mw "github.com/zitadel/zitadel/internal/api/http/middleware"
 	"github.com/zitadel/zitadel/internal/api/ui/login"
 	"github.com/zitadel/zitadel/internal/crypto"
+	"github.com/zitadel/zitadel/internal/denylist"
 	"github.com/zitadel/zitadel/internal/i18n"
 	"github.com/zitadel/zitadel/internal/query"
 	"github.com/zitadel/zitadel/internal/telemetry/tracing"
@@ -57,6 +58,7 @@ type API struct {
 	targetEncryptionAlgorithm crypto.EncryptionAlgorithm
 	translator                *i18n.Translator
 	connectOTELInterceptor    *otelconnect.Interceptor
+	actionV2DenyList          []denylist.AddressChecker
 }
 
 func (a *API) ListGrpcServices() []string {
@@ -111,6 +113,7 @@ func New(
 	targetEncryptionAlgorithm crypto.EncryptionAlgorithm,
 	translator *i18n.Translator,
 	trustRemoteSpans bool,
+	deniedIPList []denylist.AddressChecker,
 ) (_ *API, err error) {
 	api := &API{
 		port:                      port,
@@ -126,9 +129,10 @@ func New(
 		connectServices:           make(map[string][]string),
 		targetEncryptionAlgorithm: targetEncryptionAlgorithm,
 		translator:                translator,
+		actionV2DenyList:          deniedIPList,
 	}
 
-	api.grpcServer = server.CreateServer(api.verifier, systemAuthz, authZ, queries, externalDomain, tlsConfig, accessInterceptor.AccessService(), targetEncryptionAlgorithm, api.translator)
+	api.grpcServer = server.CreateServer(api.verifier, systemAuthz, authZ, queries, externalDomain, tlsConfig, accessInterceptor.AccessService(), targetEncryptionAlgorithm, api.translator, deniedIPList)
 	api.grpcGateway, err = server.CreateGateway(ctx, port, hostHeaders, accessInterceptor, tlsConfig)
 	if err != nil {
 		return nil, err
@@ -219,7 +223,7 @@ func (a *API) registerConnectServer(service server.ConnectServer) {
 		connect_middleware.AuthorizationInterceptor(a.verifier, a.systemAuthZ, a.authConfig),
 		connect_middleware.TranslationHandler(),
 		connect_middleware.QuotaExhaustedInterceptor(a.accessInterceptor.AccessService(), system_pb.SystemService_ServiceDesc.ServiceName),
-		connect_middleware.ExecutionHandler(a.targetEncryptionAlgorithm, a.queries.GetActiveSigningWebKey),
+		connect_middleware.ExecutionHandler(a.targetEncryptionAlgorithm, a.queries.GetActiveSigningWebKey, a.actionV2DenyList),
 		connect_middleware.ValidationHandler(),
 		connect_middleware.ServiceHandler(),
 		connect_middleware.ActivityInterceptor(),

internal/api/grpc/action/v2/integration_test/execution_target_test.go

@@ -71,7 +71,7 @@ func TestServer_ExecutionTarget(t *testing.T) {
 
 				// create target for target changes
 				targetCreatedName := integration.TargetName()
-				targetCreatedURL := "https://nonexistent"
+				targetCreatedURL := "https://example.com"
 				targetCreatedPayloadType := action.PayloadType_PAYLOAD_TYPE_JSON
 
 				targetCreated := instance.CreateTarget(ctx, t, targetCreatedName, targetCreatedURL, target_domain.TargetTypeCall, false, targetCreatedPayloadType)
@@ -225,7 +225,7 @@ func TestServer_ExecutionTarget(t *testing.T) {
 
 				// create target for target changes
 				targetCreatedName := integration.TargetName()
-				targetCreatedURL := "https://nonexistent"
+				targetCreatedURL := "https://example.com"
 				targetCreatedPayloadType := action.PayloadType_PAYLOAD_TYPE_JSON
 
 				targetCreated := instance.CreateTarget(ctx, t, targetCreatedName, targetCreatedURL, target_domain.TargetTypeCall, false, targetCreatedPayloadType)

internal/api/grpc/action/v2/integration_test/execution_test.go

@@ -18,7 +18,7 @@ import (
 func TestServer_SetExecution_Request(t *testing.T) {
 	instance := integration.NewInstance(CTX)
 	isolatedIAMOwnerCTX := instance.WithAuthorizationToken(CTX, integration.UserTypeIAMOwner)
-	targetResp := instance.CreateTarget(isolatedIAMOwnerCTX, t, "", "https://notexisting", target_domain.TargetTypeWebhook, false, action.PayloadType_PAYLOAD_TYPE_JSON)
+	targetResp := instance.CreateTarget(isolatedIAMOwnerCTX, t, "", "https://example.com", target_domain.TargetTypeWebhook, false, action.PayloadType_PAYLOAD_TYPE_JSON)
 
 	tests := []struct {
 		name        string
@@ -175,7 +175,7 @@ func assertSetExecutionResponse(t *testing.T, creationDate, setDate time.Time, e
 func TestServer_SetExecution_Response(t *testing.T) {
 	instance := integration.NewInstance(CTX)
 	isolatedIAMOwnerCTX := instance.WithAuthorizationToken(CTX, integration.UserTypeIAMOwner)
-	targetResp := instance.CreateTarget(isolatedIAMOwnerCTX, t, "", "https://notexisting", target_domain.TargetTypeWebhook, false, action.PayloadType_PAYLOAD_TYPE_JSON)
+	targetResp := instance.CreateTarget(isolatedIAMOwnerCTX, t, "", "https://example.com", target_domain.TargetTypeWebhook, false, action.PayloadType_PAYLOAD_TYPE_JSON)
 
 	tests := []struct {
 		name        string
@@ -319,7 +319,7 @@ func TestServer_SetExecution_Response(t *testing.T) {
 func TestServer_SetExecution_Event(t *testing.T) {
 	instance := integration.NewInstance(CTX)
 	isolatedIAMOwnerCTX := instance.WithAuthorizationToken(CTX, integration.UserTypeIAMOwner)
-	targetResp := instance.CreateTarget(isolatedIAMOwnerCTX, t, "", "https://notexisting", target_domain.TargetTypeWebhook, false, action.PayloadType_PAYLOAD_TYPE_JSON)
+	targetResp := instance.CreateTarget(isolatedIAMOwnerCTX, t, "", "https://example.com", target_domain.TargetTypeWebhook, false, action.PayloadType_PAYLOAD_TYPE_JSON)
 
 	tests := []struct {
 		name        string
@@ -482,7 +482,7 @@ func TestServer_SetExecution_Event(t *testing.T) {
 func TestServer_SetExecution_Function(t *testing.T) {
 	instance := integration.NewInstance(CTX)
 	isolatedIAMOwnerCTX := instance.WithAuthorizationToken(CTX, integration.UserTypeIAMOwner)
-	targetResp := instance.CreateTarget(isolatedIAMOwnerCTX, t, "", "https://notexisting", target_domain.TargetTypeWebhook, false, action.PayloadType_PAYLOAD_TYPE_JSON)
+	targetResp := instance.CreateTarget(isolatedIAMOwnerCTX, t, "", "https://example.com", target_domain.TargetTypeWebhook, false, action.PayloadType_PAYLOAD_TYPE_JSON)
 
 	tests := []struct {
 		name        string

internal/api/grpc/action/v2beta/integration_test/execution_target_test.go

@@ -71,7 +71,7 @@ func TestServer_ExecutionTarget(t *testing.T) {
 
 				// create target for target changes
 				targetCreatedName := integration.TargetName()
-				targetCreatedURL := "https://nonexistent"
+				targetCreatedURL := "https://example.com"
 
 				targetCreated := instance.CreateTargetWithoutPayloadType(ctx, t, targetCreatedName, targetCreatedURL, target_domain.TargetTypeCall, false)
 
@@ -221,7 +221,7 @@ func TestServer_ExecutionTarget(t *testing.T) {
 
 				// create target for target changes
 				targetCreatedName := integration.TargetName()
-				targetCreatedURL := "https://nonexistent"
+				targetCreatedURL := "https://example.com"
 
 				targetCreated := instance.CreateTargetWithoutPayloadType(ctx, t, targetCreatedName, targetCreatedURL, target_domain.TargetTypeCall, false)
 

internal/api/grpc/action/v2beta/integration_test/execution_test.go

@@ -18,7 +18,7 @@ import (
 func TestServer_SetExecution_Request(t *testing.T) {
 	instance := integration.NewInstance(CTX)
 	isolatedIAMOwnerCTX := instance.WithAuthorizationToken(CTX, integration.UserTypeIAMOwner)
-	targetResp := instance.CreateTargetWithoutPayloadType(isolatedIAMOwnerCTX, t, "", "https://notexisting", target_domain.TargetTypeWebhook, false)
+	targetResp := instance.CreateTargetWithoutPayloadType(isolatedIAMOwnerCTX, t, "", "https://example.com", target_domain.TargetTypeWebhook, false)
 
 	tests := []struct {
 		name        string
@@ -175,7 +175,7 @@ func assertSetExecutionResponse(t *testing.T, creationDate, setDate time.Time, e
 func TestServer_SetExecution_Response(t *testing.T) {
 	instance := integration.NewInstance(CTX)
 	isolatedIAMOwnerCTX := instance.WithAuthorizationToken(CTX, integration.UserTypeIAMOwner)
-	targetResp := instance.CreateTargetWithoutPayloadType(isolatedIAMOwnerCTX, t, "", "https://notexisting", target_domain.TargetTypeWebhook, false)
+	targetResp := instance.CreateTargetWithoutPayloadType(isolatedIAMOwnerCTX, t, "", "https://example.com", target_domain.TargetTypeWebhook, false)
 
 	tests := []struct {
 		name        string
@@ -319,7 +319,7 @@ func TestServer_SetExecution_Response(t *testing.T) {
 func TestServer_SetExecution_Event(t *testing.T) {
 	instance := integration.NewInstance(CTX)
 	isolatedIAMOwnerCTX := instance.WithAuthorizationToken(CTX, integration.UserTypeIAMOwner)
-	targetResp := instance.CreateTargetWithoutPayloadType(isolatedIAMOwnerCTX, t, "", "https://notexisting", target_domain.TargetTypeWebhook, false)
+	targetResp := instance.CreateTargetWithoutPayloadType(isolatedIAMOwnerCTX, t, "", "https://example.com", target_domain.TargetTypeWebhook, false)
 
 	tests := []struct {
 		name        string
@@ -482,7 +482,7 @@ func TestServer_SetExecution_Event(t *testing.T) {
 func TestServer_SetExecution_Function(t *testing.T) {
 	instance := integration.NewInstance(CTX)
 	isolatedIAMOwnerCTX := instance.WithAuthorizationToken(CTX, integration.UserTypeIAMOwner)
-	targetResp := instance.CreateTargetWithoutPayloadType(isolatedIAMOwnerCTX, t, "", "https://notexisting", target_domain.TargetTypeWebhook, false)
+	targetResp := instance.CreateTargetWithoutPayloadType(isolatedIAMOwnerCTX, t, "", "https://example.com", target_domain.TargetTypeWebhook, false)
 
 	tests := []struct {
 		name        string

internal/api/grpc/server/connect_middleware/execution_interceptor.go

@@ -13,6 +13,7 @@ import (
 	"github.com/zitadel/zitadel/internal/api/authz"
 	http_utils "github.com/zitadel/zitadel/internal/api/http"
 	"github.com/zitadel/zitadel/internal/crypto"
+	"github.com/zitadel/zitadel/internal/denylist"
 	"github.com/zitadel/zitadel/internal/execution"
 	target_domain "github.com/zitadel/zitadel/internal/execution/target"
 	"github.com/zitadel/zitadel/internal/telemetry/tracing"
@@ -26,12 +27,12 @@ var headersToForward = map[string]bool{
 	strings.ToLower(http_utils.Origin):        true,
 }
 
-func ExecutionHandler(alg crypto.EncryptionAlgorithm, activeSigningKey execution.GetActiveSigningWebKey) connect.UnaryInterceptorFunc {
+func ExecutionHandler(alg crypto.EncryptionAlgorithm, activeSigningKey execution.GetActiveSigningWebKey, deniedIPList []denylist.AddressChecker) connect.UnaryInterceptorFunc {
 	return func(handler connect.UnaryFunc) connect.UnaryFunc {
 		return func(ctx context.Context, req connect.AnyRequest) (_ connect.AnyResponse, err error) {
 
 			requestTargets := execution.QueryExecutionTargetsForRequest(ctx, req.Spec().Procedure)
-			handledReq, err := executeTargetsForRequest(ctx, requestTargets, req.Spec().Procedure, req, alg, activeSigningKey)
+			handledReq, err := executeTargetsForRequest(ctx, requestTargets, req.Spec().Procedure, req, alg, activeSigningKey, deniedIPList)
 			if err != nil {
 				return nil, err
 			}
@@ -42,12 +43,12 @@ func ExecutionHandler(alg crypto.EncryptionAlgorithm, activeSigningKey execution
 			}
 
 			responseTargets := execution.QueryExecutionTargetsForResponse(ctx, req.Spec().Procedure)
-			return executeTargetsForResponse(ctx, responseTargets, req.Spec().Procedure, handledReq, response, alg, activeSigningKey)
+			return executeTargetsForResponse(ctx, responseTargets, req.Spec().Procedure, handledReq, response, alg, activeSigningKey, deniedIPList)
 		}
 	}
 }
 
-func executeTargetsForRequest(ctx context.Context, targets []target_domain.Target, fullMethod string, req connect.AnyRequest, alg crypto.EncryptionAlgorithm, activeSigningKey execution.GetActiveSigningWebKey) (_ connect.AnyRequest, err error) {
+func executeTargetsForRequest(ctx context.Context, targets []target_domain.Target, fullMethod string, req connect.AnyRequest, alg crypto.EncryptionAlgorithm, activeSigningKey execution.GetActiveSigningWebKey, deniedIPList []denylist.AddressChecker) (_ connect.AnyRequest, err error) {
 	ctx, span := tracing.NewSpan(ctx)
 	defer func() { span.EndWithError(err) }()
 
@@ -67,14 +68,14 @@ func executeTargetsForRequest(ctx context.Context, targets []target_domain.Targe
 		Headers:    SetRequestHeaders(req.Header()),
 	}
 
-	_, err = execution.CallTargets(ctx, targets, info, alg, activeSigningKey)
+	_, err = execution.CallTargets(ctx, targets, info, alg, activeSigningKey, deniedIPList)
 	if err != nil {
 		return nil, err
 	}
 	return req, nil
 }
 
-func executeTargetsForResponse(ctx context.Context, targets []target_domain.Target, fullMethod string, req connect.AnyRequest, resp connect.AnyResponse, alg crypto.EncryptionAlgorithm, activeSigningKey execution.GetActiveSigningWebKey) (_ connect.AnyResponse, err error) {
+func executeTargetsForResponse(ctx context.Context, targets []target_domain.Target, fullMethod string, req connect.AnyRequest, resp connect.AnyResponse, alg crypto.EncryptionAlgorithm, activeSigningKey execution.GetActiveSigningWebKey, deniedIPList []denylist.AddressChecker) (_ connect.AnyResponse, err error) {
 	ctx, span := tracing.NewSpan(ctx)
 	defer func() { span.EndWithError(err) }()
 
@@ -95,7 +96,7 @@ func executeTargetsForResponse(ctx context.Context, targets []target_domain.Targ
 		Headers:    SetRequestHeaders(req.Header()),
 	}
 
-	_, err = execution.CallTargets(ctx, targets, info, alg, activeSigningKey)
+	_, err = execution.CallTargets(ctx, targets, info, alg, activeSigningKey, deniedIPList)
 	if err != nil {
 		return nil, err
 	}

internal/api/grpc/server/connect_middleware/execution_interceptor_test.go

@@ -21,6 +21,7 @@ import (
 	"google.golang.org/protobuf/types/known/structpb"
 
 	"github.com/zitadel/zitadel/internal/crypto"
+	"github.com/zitadel/zitadel/internal/denylist"
 	"github.com/zitadel/zitadel/internal/execution"
 	target_domain "github.com/zitadel/zitadel/internal/execution/target"
 )
@@ -74,6 +75,10 @@ func newMockContextInfoResponse(fullMethod, request, response string) *ContextIn
 }
 
 func Test_executeTargetsForGRPCFullMethod_request(t *testing.T) {
+	deniedLocalhost, err := denylist.NewHostChecker("127.0.0.1")
+	require.NoError(t, err)
+	deniedIPs := []denylist.AddressChecker{deniedLocalhost}
+
 	type target struct {
 		reqBody             execution.ContextInfo
 		sleep               time.Duration
@@ -89,9 +94,10 @@ func Test_executeTargetsForGRPCFullMethod_request(t *testing.T) {
 		fullMethod             string
 		req                    connect.AnyRequest
 		getActiveSigningWebKey execution.GetActiveSigningWebKey
+		deniedIPs              []denylist.AddressChecker
 	}
 	type res struct {
-		want    interface{}
+		want    any
 		wantErr bool
 	}
 	tests := []struct {
@@ -286,6 +292,37 @@ func Test_executeTargetsForGRPCFullMethod_request(t *testing.T) {
 				want: newMockContentRequest("content1"),
 			},
 		},
+		{
+			"when target endpoint is in deny list should return error",
+			args{
+				ctx:        context.Background(),
+				fullMethod: "/service/method",
+				executionTargets: []target_domain.Target{
+					{
+						ExecutionID:      "request./zitadel.session.v2.SessionService/SetSession",
+						TargetID:         "target",
+						TargetType:       target_domain.TargetTypeCall,
+						Timeout:          time.Minute,
+						InterruptOnError: true,
+						Endpoint:         "127.0.0.1",
+					},
+				},
+				targets: []target{
+					{
+						reqBody:             newMockContextInfoRequest("/service/method", "content"),
+						respBody:            newMockContentResponse("content1"),
+						sleep:               0,
+						statusCode:          http.StatusOK,
+						requestVerification: validateJSONPayload,
+					},
+				},
+				req:       newMockContentRequest("content"),
+				deniedIPs: deniedIPs,
+			},
+			res{
+				wantErr: true,
+			},
+		},
 		{
 			"target async, timeout",
 			args{
@@ -631,6 +668,7 @@ func Test_executeTargetsForGRPCFullMethod_request(t *testing.T) {
 				tt.args.req,
 				nil,
 				tt.args.getActiveSigningWebKey,
+				tt.args.deniedIPs,
 			)
 
 			if tt.res.wantErr {
@@ -736,6 +774,9 @@ func validateJWEPayload(t *testing.T) func(expected, sent []byte) bool {
 }
 
 func Test_executeTargetsForGRPCFullMethod_response(t *testing.T) {
+	deniedLocalhost, err := denylist.NewHostChecker("127.0.0.1")
+	require.NoError(t, err)
+	deniedIPs := []denylist.AddressChecker{deniedLocalhost}
 	type target struct {
 		reqBody    execution.ContextInfo
 		sleep      time.Duration
@@ -750,6 +791,7 @@ func Test_executeTargetsForGRPCFullMethod_response(t *testing.T) {
 		fullMethod       string
 		req              connect.AnyRequest
 		resp             connect.AnyResponse
+		deniedIPs        []denylist.AddressChecker
 	}
 	type res struct {
 		want    interface{}
@@ -844,6 +886,37 @@ func Test_executeTargetsForGRPCFullMethod_response(t *testing.T) {
 				want: newMockContentResponse("response1"),
 			},
 		},
+		{
+			"when target endpoint is in deny list should return error",
+			args{
+				ctx:        context.Background(),
+				fullMethod: "/service/method",
+				executionTargets: []target_domain.Target{
+					{
+						ExecutionID:      "response./zitadel.session.v2.SessionService/SetSession",
+						TargetID:         "target",
+						TargetType:       target_domain.TargetTypeCall,
+						Timeout:          time.Minute,
+						InterruptOnError: true,
+						Endpoint:         "127.0.0.1",
+					},
+				},
+				targets: []target{
+					{
+						reqBody:    newMockContextInfoResponse("/service/method", "request", "response"),
+						respBody:   newMockContentResponse("response1"),
+						sleep:      0,
+						statusCode: http.StatusOK,
+					},
+				},
+				req:       newMockContentRequest("request"),
+				resp:      newMockContentResponse("response"),
+				deniedIPs: deniedIPs,
+			},
+			res{
+				wantErr: true,
+			},
+		},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
@@ -869,6 +942,7 @@ func Test_executeTargetsForGRPCFullMethod_response(t *testing.T) {
 				tt.args.resp,
 				nil,
 				mockGetActiveSigningWebKey(),
+				tt.args.deniedIPs,
 			)
 
 			if tt.res.wantErr {

internal/api/grpc/server/middleware/execution_interceptor.go

@@ -13,16 +13,17 @@ import (
 	"github.com/zitadel/zitadel/internal/api/authz"
 	"github.com/zitadel/zitadel/internal/api/grpc/server/connect_middleware"
 	"github.com/zitadel/zitadel/internal/crypto"
+	"github.com/zitadel/zitadel/internal/denylist"
 	"github.com/zitadel/zitadel/internal/execution"
 	target_domain "github.com/zitadel/zitadel/internal/execution/target"
 	"github.com/zitadel/zitadel/internal/telemetry/tracing"
 )
 
-func ExecutionHandler(alg crypto.EncryptionAlgorithm, activeSigningKey execution.GetActiveSigningWebKey) grpc.UnaryServerInterceptor {
+func ExecutionHandler(alg crypto.EncryptionAlgorithm, activeSigningKey execution.GetActiveSigningWebKey, deniedIPList []denylist.AddressChecker) grpc.UnaryServerInterceptor {
 	return func(ctx context.Context, req interface{}, info *grpc.UnaryServerInfo, handler grpc.UnaryHandler) (interface{}, error) {
 		requestTargets := execution.QueryExecutionTargetsForRequest(ctx, info.FullMethod)
 		// call targets otherwise return req
-		handledReq, err := executeTargetsForRequest(ctx, requestTargets, info.FullMethod, req, alg, activeSigningKey)
+		handledReq, err := executeTargetsForRequest(ctx, requestTargets, info.FullMethod, req, alg, activeSigningKey, deniedIPList)
 		if err != nil {
 			return nil, err
 		}
@@ -33,11 +34,11 @@ func ExecutionHandler(alg crypto.EncryptionAlgorithm, activeSigningKey execution
 		}
 
 		responseTargets := execution.QueryExecutionTargetsForResponse(ctx, info.FullMethod)
-		return executeTargetsForResponse(ctx, responseTargets, info.FullMethod, handledReq, response, alg, activeSigningKey)
+		return executeTargetsForResponse(ctx, responseTargets, info.FullMethod, handledReq, response, alg, activeSigningKey, deniedIPList)
 	}
 }
 
-func executeTargetsForRequest(ctx context.Context, targets []target_domain.Target, fullMethod string, req interface{}, alg crypto.EncryptionAlgorithm, activeSigningKey execution.GetActiveSigningWebKey) (_ interface{}, err error) {
+func executeTargetsForRequest(ctx context.Context, targets []target_domain.Target, fullMethod string, req any, alg crypto.EncryptionAlgorithm, activeSigningKey execution.GetActiveSigningWebKey, deniedIPList []denylist.AddressChecker) (_ interface{}, err error) {
 	ctx, span := tracing.NewSpan(ctx)
 	defer func() { span.EndWithError(err) }()
 
@@ -58,10 +59,10 @@ func executeTargetsForRequest(ctx context.Context, targets []target_domain.Targe
 		Headers:    connect_middleware.SetRequestHeaders(md),
 	}
 
-	return execution.CallTargets(ctx, targets, info, alg, activeSigningKey)
+	return execution.CallTargets(ctx, targets, info, alg, activeSigningKey, deniedIPList)
 }
 
-func executeTargetsForResponse(ctx context.Context, targets []target_domain.Target, fullMethod string, req, resp interface{}, alg crypto.EncryptionAlgorithm, activeSigningKey execution.GetActiveSigningWebKey) (_ interface{}, err error) {
+func executeTargetsForResponse(ctx context.Context, targets []target_domain.Target, fullMethod string, req, resp interface{}, alg crypto.EncryptionAlgorithm, activeSigningKey execution.GetActiveSigningWebKey, deniedIPList []denylist.AddressChecker) (_ interface{}, err error) {
 	ctx, span := tracing.NewSpan(ctx)
 	defer func() { span.EndWithError(err) }()
 
@@ -83,7 +84,7 @@ func executeTargetsForResponse(ctx context.Context, targets []target_domain.Targ
 		Headers:    connect_middleware.SetRequestHeaders(md),
 	}
 
-	return execution.CallTargets(ctx, targets, info, alg, activeSigningKey)
+	return execution.CallTargets(ctx, targets, info, alg, activeSigningKey, deniedIPList)
 }
 
 var _ execution.ContextInfo = &ContextInfoRequest{}

internal/api/grpc/server/middleware/execution_interceptor_test.go

@@ -20,6 +20,7 @@ import (
 	"google.golang.org/protobuf/types/known/structpb"
 
 	"github.com/zitadel/zitadel/internal/crypto"
+	"github.com/zitadel/zitadel/internal/denylist"
 	"github.com/zitadel/zitadel/internal/execution"
 	target_domain "github.com/zitadel/zitadel/internal/execution/target"
 )
@@ -63,6 +64,10 @@ func newMockContextInfoResponse(fullMethod, request, response string) *ContextIn
 }
 
 func Test_executeTargetsForGRPCFullMethod_request(t *testing.T) {
+	deniedLocalhost, err := denylist.NewHostChecker("127.0.0.1")
+	require.NoError(t, err)
+	deniedIPs := []denylist.AddressChecker{deniedLocalhost}
+
 	type target struct {
 		reqBody             execution.ContextInfo
 		sleep               time.Duration
@@ -78,6 +83,7 @@ func Test_executeTargetsForGRPCFullMethod_request(t *testing.T) {
 		fullMethod             string
 		req                    interface{}
 		getActiveSigningWebKey execution.GetActiveSigningWebKey
+		deniedIPs              []denylist.AddressChecker
 	}
 	type res struct {
 		want    interface{}
@@ -275,6 +281,36 @@ func Test_executeTargetsForGRPCFullMethod_request(t *testing.T) {
 				want: newMockContentRequest("content1"),
 			},
 		},
+		{
+			"when target endpoint is in denylist should return error",
+			args{
+				ctx:        context.Background(),
+				fullMethod: "/service/method",
+				executionTargets: []target_domain.Target{
+					{
+						ExecutionID:      "request./zitadel.session.v2.SessionService/SetSession",
+						TargetID:         "target",
+						TargetType:       target_domain.TargetTypeCall,
+						Timeout:          time.Minute,
+						InterruptOnError: true,
+					},
+				},
+				targets: []target{
+					{
+						reqBody:             newMockContextInfoRequest("/service/method", "content"),
+						respBody:            newMockContentRequest("content1"),
+						sleep:               0,
+						statusCode:          http.StatusOK,
+						requestVerification: validateJSONPayload,
+					},
+				},
+				req:       newMockContentRequest("content"),
+				deniedIPs: deniedIPs,
+			},
+			res{
+				wantErr: true,
+			},
+		},
 		{
 			"target async, timeout",
 			args{
@@ -620,6 +656,7 @@ func Test_executeTargetsForGRPCFullMethod_request(t *testing.T) {
 				tt.args.req,
 				nil,
 				tt.args.getActiveSigningWebKey,
+				tt.args.deniedIPs,
 			)
 
 			if tt.res.wantErr {
@@ -725,6 +762,10 @@ func validateJWEPayload(t *testing.T) func(expected, sent []byte) bool {
 }
 
 func Test_executeTargetsForGRPCFullMethod_response(t *testing.T) {
+	deniedLocalhost, err := denylist.NewHostChecker("127.0.0.1")
+	require.NoError(t, err)
+	deniedIPs := []denylist.AddressChecker{deniedLocalhost}
+
 	type target struct {
 		reqBody    execution.ContextInfo
 		sleep      time.Duration
@@ -739,6 +780,7 @@ func Test_executeTargetsForGRPCFullMethod_response(t *testing.T) {
 		fullMethod       string
 		req              interface{}
 		resp             interface{}
+		deniedIPs        []denylist.AddressChecker
 	}
 	type res struct {
 		want    interface{}
@@ -833,6 +875,36 @@ func Test_executeTargetsForGRPCFullMethod_response(t *testing.T) {
 				want: newMockContentRequest("response1"),
 			},
 		},
+		{
+			"when target endpoint is in deny list should return error",
+			args{
+				ctx:        context.Background(),
+				fullMethod: "/service/method",
+				executionTargets: []target_domain.Target{
+					{
+						ExecutionID:      "response./zitadel.session.v2.SessionService/SetSession",
+						TargetID:         "target",
+						TargetType:       target_domain.TargetTypeCall,
+						Timeout:          time.Minute,
+						InterruptOnError: true,
+					},
+				},
+				targets: []target{
+					{
+						reqBody:    newMockContextInfoResponse("/service/method", "request", "response"),
+						respBody:   newMockContentRequest("response1"),
+						sleep:      0,
+						statusCode: http.StatusOK,
+					},
+				},
+				req:       newMockContentRequest("request"),
+				resp:      newMockContentRequest("response"),
+				deniedIPs: deniedIPs,
+			},
+			res{
+				wantErr: true,
+			},
+		},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
@@ -858,6 +930,7 @@ func Test_executeTargetsForGRPCFullMethod_response(t *testing.T) {
 				tt.args.resp,
 				nil,
 				mockGetActiveSigningWebKey(),
+				tt.args.deniedIPs,
 			)
 
 			if tt.res.wantErr {

internal/api/grpc/server/server.go

@@ -16,6 +16,7 @@ import (
 	grpc_api "github.com/zitadel/zitadel/internal/api/grpc"
 	"github.com/zitadel/zitadel/internal/api/grpc/server/middleware"
 	"github.com/zitadel/zitadel/internal/crypto"
+	"github.com/zitadel/zitadel/internal/denylist"
 	"github.com/zitadel/zitadel/internal/i18n"
 	"github.com/zitadel/zitadel/internal/logstore"
 	"github.com/zitadel/zitadel/internal/logstore/record"
@@ -64,6 +65,7 @@ func CreateServer(
 	accessSvc *logstore.Service[*record.AccessLog],
 	targetEncAlg crypto.EncryptionAlgorithm,
 	translator *i18n.Translator,
+	deniedIPList []denylist.AddressChecker,
 ) *grpc.Server {
 	metricTypes := []metrics.MetricType{metrics.MetricTypeTotalCount, metrics.MetricTypeRequestCount, metrics.MetricTypeStatusCode}
 	serverOptions := []grpc.ServerOption{
@@ -80,7 +82,7 @@ func CreateServer(
 				middleware.AuthorizationInterceptor(verifier, systemAuthz, authConfig),
 				middleware.TranslationHandler(),
 				middleware.QuotaExhaustedInterceptor(accessSvc, system_pb.SystemService_ServiceDesc.ServiceName),
-				middleware.ExecutionHandler(targetEncAlg, queries.GetActiveSigningWebKey),
+				middleware.ExecutionHandler(targetEncAlg, queries.GetActiveSigningWebKey, deniedIPList),
 				middleware.ValidationHandler(),
 				middleware.ServiceHandler(),
 				middleware.ActivityInterceptor(),

internal/api/oidc/userinfo.go

@@ -461,7 +461,7 @@ func (s *Server) userinfoFlows(ctx context.Context, qu *query.OIDCUserInfo, user
 		UserGrants:   qu.UserGrants,
 	}
 
-	resp, err := execution.CallTargets(ctx, executionTargets, info, s.targetEncryptionAlgorithm, s.query.GetActiveSigningWebKey)
+	resp, err := execution.CallTargets(ctx, executionTargets, info, s.targetEncryptionAlgorithm, s.query.GetActiveSigningWebKey, s.command.ActionsV2DenyList)
 	if err != nil {
 		return err
 	}

internal/api/saml/storage.go

@@ -401,7 +401,7 @@ func (p *Storage) getCustomAttributes(ctx context.Context, user *query.User, use
 		UserGrants: userGrants.UserGrants,
 	}
 
-	resp, err := execution.CallTargets(ctx, executionTargets, info, p.targetEncAlg, p.query.GetActiveSigningWebKey)
+	resp, err := execution.CallTargets(ctx, executionTargets, info, p.targetEncAlg, p.query.GetActiveSigningWebKey, p.command.ActionsV2DenyList)
 	if err != nil {
 		return nil, err
 	}