Broken Access Control and SSRF

Broken access control includes IDOR (changing an ID to access others' data), missing function-level checks (calling admin endpoints), and mass assignment (setting role=admin in a body). SSRF tricks your server into fetching attacker-chosen URLs — internal services or cloud metadata endpoints. Defend with server-side checks on every object, allow-listed input fields, and for SSRF: allow-list destinations, resolve and block private/link-local IP ranges, disable redirects, and use IMDSv2 on AWS.

# SSRF-safe URL fetch (concept)
ALLOWED_HOSTS = {"images.partner.com", "cdn.partner.com"}
def safe_fetch(url):
    u = urlparse(url)
    if u.scheme != "https" or u.hostname not in ALLOWED_HOSTS:
        raise Forbidden("Destination not allowed")
    ip = ipaddress.ip_address(socket.gethostbyname(u.hostname))
    if ip.is_private or ip.is_loopback or ip.is_link_local:      # blocks 169.254.169.254
        raise Forbidden("Internal address")
    return http.get(url, allow_redirects=False, timeout=5)        # pin the resolved IP in real code (DNS rebinding)

Common pitfalls

• Checking authorization only in the UI.
• SSRF filters based on string matching of URLs.
• Binding request bodies directly onto models (mass assignment).

Key points

• Object-level checks everywhere
• Allow-list fields and destinations
• Block internal addresses; IMDSv2

Further reading: OWASP SSRF Prevention Cheat Sheet