What is SSRF (Server-Side Request Forgery) and how do you prevent it?

Summary

SSRF happens when an attacker makes your server fetch a URL of their choosing, reaching internal services or cloud metadata endpoints (e.g., 169.254.169.254) to steal credentials. Prevent it by allow-listing destinations, resolving and blocking private/link-local IPs (including after redirects and DNS rebinding), and isolating fetchers.

Longer Answer

Features like URL previews, webhooks, image fetching and PDF rendering are common SSRF vectors. Use IMDSv2 on AWS (session tokens) to blunt metadata theft, disable redirects or re-validate them, and run fetchers in a network segment without internal access.

Key Points

• Server fetches attacker URLs
• Block private/metadata IPs
• Re-check after redirects/DNS
• Allow-list destinations
• IMDSv2 and network isolation