diff --git a/lib/core/httpclient_next.js b/lib/core/httpclient_next.js
index 8b127cebbf..1a18e6ce23 100644
--- a/lib/core/httpclient_next.js
+++ b/lib/core/httpclient_next.js
@@ -2,13 +2,20 @@ const { HttpClient } = require('urllib-next');
 const ms = require('humanize-ms');
 
 class HttpClientNext extends HttpClient {
-  constructor(app) {
+  constructor(app, options) {
     normalizeConfig(app);
-    const config = app.config.httpclient;
+    options = options || {};
+    options = {
+      ...app.config.httpclient,
+      ...options,
+    };
     super({
       app,
-      defaultArgs: config.request,
-      allowH2: config.allowH2,
+      defaultArgs: options.request,
+      allowH2: options.allowH2,
+      // use on egg-security ssrf
+      // https://github.com/eggjs/egg-security/blob/master/lib/extend/safe_curl.js#L11
+      checkAddress: options.checkAddress,
     });
     this.app = app;
   }
diff --git a/lib/egg.js b/lib/egg.js
index aabba225b4..a70c69fae8 100644
--- a/lib/egg.js
+++ b/lib/egg.js
@@ -286,6 +286,22 @@ class EggApplication extends EggCore {
     return await this.httpclient.request(url, opts);
   }
 
+  /**
+   * Create a new HttpClient instance with custom options
+   * @param {Object} [options] HttpClient init options
+   */
+  createHttpClient(options) {
+    let httpClient;
+    if (this.config.httpclient.useHttpClientNext) {
+      httpClient = new this.HttpClientNext(this, options);
+    } else if (this.config.httpclient.enableDNSCache) {
+      httpClient = new DNSCacheHttpClient(this, options);
+    } else {
+      httpClient = new this.HttpClient(this, options);
+    }
+    return httpClient;
+  }
+
   /**
    * HttpClient instance
    * @see https://github.com/node-modules/urllib
@@ -293,13 +309,7 @@ class EggApplication extends EggCore {
    */
   get httpclient() {
     if (!this[HTTPCLIENT]) {
-      if (this.config.httpclient.useHttpClientNext) {
-        this[HTTPCLIENT] = new this.HttpClientNext(this);
-      } else if (this.config.httpclient.enableDNSCache) {
-        this[HTTPCLIENT] = new DNSCacheHttpClient(this);
-      } else {
-        this[HTTPCLIENT] = new this.HttpClient(this);
-      }
+      this[HTTPCLIENT] = this.createHttpClient();
     }
     return this[HTTPCLIENT];
   }