Server-Side Request Forgery (SSRF) Defense

SSRF occurs when an attacker controls a server-side request target and uses the server as a network vantage point.

Use an allowlist of schemes, hosts, ports, and resolved addresses; block loopback, link-local, metadata, private, and internal ranges; re-check DNS after resolution; disable or constrain redirects; and isolate outbound requests at the network layer.

POST /fetch HTTP/1.1
Content-Type: application/json

{"url":"https://allowed.example/resource"}