Server-Side Request Forgery

Servers can often reach systems that a visitor's browser can't: loopback interfaces, private networks, and cloud infrastructure endpoints. Server-side request forgery (SSRF) happens when an attacker tricks a server into sending a request that borrows that privileged network position.

Imagine a travel app whose image-preview tool accepts a URL and fetches it directly:

response, err := http.Get(imageURL)

The feature is supposed to preview a public hotel image, but the input is really an unrestricted request destination. An attacker can use the tool to make the server fetch its own /health endpoint, probe a private admin service, or contact a cloud metadata address. The preview might then return sensitive information that was never reachable from the attacker's network.

SSRF can also do damage even when the response is hidden or ignored. A forged request can scan internal ports or trigger state-changing actions on a service that trusts the local network. Maybe the attacker isn't trying to read the response, just get your server to take your database offline or delete a file.

Whenever a feature accepts a URL or slug for a server-side request, ask:

• Which destinations does the feature actually need?
• What can the server reach that the requesting user cannot?