Defending Against SSRF

The safest SSRF defense is to avoid arbitrary destinations. If an app needs images from one provider, accept HTTPS URLs for that exact host and reject everything else.

Parse and validate the URL before sending a request:

func allowedURL(rawURL string) (*url.URL, bool) {
    parsed, err := url.Parse(rawURL)
    if err != nil || parsed.Scheme != "https" {
        return nil, false
    }
    if parsed.User != nil || parsed.Host != "images.example.com" {
        return nil, false
    }
    return parsed, true
}

Compare the parsed host exactly. That rejects unexpected ports and lookalike hosts such as images.example.com.attacker.test.

The HTTP client needs its own boundaries too. Set request, response-header, and TLS-handshake timeouts so a slow approved host can't hold resources indefinitely. Disable proxy discovery when it is not part of the feature's design.

Redirects need an explicit policy. Go's http.Client follows redirects by default, so an approved URL might redirect to an internal destination. A CheckRedirect function can return http.ErrUseLastResponse, leaving the redirect response unread for the caller to reject.