SSRF

في هذا الدرس

protect features that fetch URLs.

الموضوعات المخطط لها

• SSRF (server-side request forgery): the server is tricked into calling a URL the attacker picks, such as an internal service or the cloud metadata address.
• Typical features at risk: import from URL, webhooks, image fetch.
• Best fix: an allow-list of permitted hosts and schemes, not a deny-list.
• Resolve the host and block private and loopback addresses; do not follow redirects blindly.
• Set timeouts and size limits.