SSRF (Server-Side Request Forgery) occurs when an application fetches a URL supplied or influenced by a user and does not restrict where it may go. The server then makes requests on the attacker's behalf from inside the trusted network.
Why it matters
Servers often can reach resources an outsider cannot: internal admin pages, databases or cloud metadata services that hand out credentials. A feature as ordinary as "import from URL", a webhook tester or a link preview can become a path to them. SSRF is called out in the OWASP Top 10 for this reason.
Example
A link-preview feature fetches any address a user enters. A defensive design uses an allowlist of permitted hosts, resolves the address and rejects private or loopback ranges, disables redirects or re-checks them, and runs the fetcher in a network segment with no internal access. Cloud providers also offer metadata protections that require extra headers or session tokens.
Common mistakes
- Using a blocklist of bad hosts rather than an allowlist.
- Checking the hostname but not the resolved IP address, which can change.
- Following redirects blindly.
- Returning the fetched content directly to the user.
Related
Get notified when this term updates
Plus occasional practical tips on uptime and monitoring, nothing else. Unsubscribe anytime.
यह पेज सामान्य जानकारी है, जिसे हमारी संपादकीय टीम ने लिखा है और दस्तावेज़ीकरण बदलने पर अपडेट किया जाता है। सर्वर और प्रदाता अलग-अलग होते हैं, इसलिए बदलाव पहले सुरक्षित तरीके से जाँचें। देखें: संपादकीय नीति और अस्वीकरण.