SSRF
On This Lesson 4 topics
This lesson is planned. The outline below lists the topics it will cover. The full lesson has not been published yet.
In this lesson
protect features that fetch URLs.
Planned topics
- SSRF (server-side request forgery): the server is tricked into calling a URL the attacker picks, such as an internal service or the cloud metadata address.
- Typical features at risk: import from URL, webhooks, image fetch.
- Best fix: an allow-list of permitted hosts and schemes, not a deny-list.
- Resolve the host and block private and loopback addresses; do not follow redirects blindly.
- Set timeouts and size limits.
Draft outline details
Demonstration
an attack URL http://169.254.169.254/latest/meta-data/ and the allow-list check that refuses it.
Check your understanding
Allow-list or deny-list for permitted hosts?
Show answer
Allow-list.
Practice
Apply this lesson with the module's lab, exercises and quiz.
Marking a lesson complete is optional and you can undo it any time. Your progress stays in this browser.