This lesson's interactive features are locked, please to keep using them

Defending Against SSRF

The safest SSRF defense is to avoid arbitrary destinations. If a travel app needs to fetch images from two providers, accept HTTPS URLs for those exact origins and reject everything else.

Or even better, accept image IDs and build the URLs within the server code.

For example, you can explicitly parse and validate the URL before any request is sent:

const ALLOWED_IMAGE_ORIGINS = new Set([
  "https://images.example.com",
  "https://cdn.example.com",
]);

function parseAllowedImageUrl(rawUrl: string): URL | undefined {
  let url: URL;
  try {
    url = new URL(rawUrl);
  } catch {
    return undefined;
  }

  if (url.protocol !== "https:") return undefined;
  if (url.username || url.password) return undefined;
  if (!ALLOWED_IMAGE_ORIGINS.has(url.origin)) return undefined;
  return url;
}

Compare parsed origins exactly. That will make sure you reject unexpected ports and lookalike hosts like images.example.com.attacker.test.

Also give outbound requests a deadline, so a slow approved host can't hold server resources indefinitely. You can pass AbortSignal.timeout() with a value in milliseconds as the fetch signal – e.g., AbortSignal.timeout(10_000) for a 10-second deadline.

Redirects need their own policy. fetch() follows redirects by default, which means an approved URL might redirect to an internal destination like 127.0.0.1. Disable automatic redirects with redirect: "manual" and reject redirect responses before reading or returning their bodies!

An exact-origin allowlist avoids most DNS ambiguity, but if you truly need arbitrary public hosts, blocking private addresses gets much harder: you have to validate every resolved IPv4 and IPv6 address and ensure the connection uses an address you checked. A separate DNS lookup followed by a normal fetch doesn't guarantee both operations use the same address, so it doesn't stop DNS rebinding by itself.

Assignment

Bearly Secure's image-preview helper can fetch any destination the server can reach. Restrict remote image previews to exact, approved HTTPS origins.

Reset the database and start the app.
Log in as Theo ([email protected] / password123) and use the admin image-preview page http://localhost:3000/admin/image-preview to fetch the following URL, then stop the app.
```
http://127.0.0.1:3000/health
```
In src/integrations/remoteImagePreview.ts, add a parseAllowedImageUrl helper function. Only allow the following origin:
```
https://storage.googleapis.com
```
In the fetchRemoteImagePreview function, parse and validate the image URL. If it fails, throw a RemoteImagePreviewError with this message:
```
Use an HTTPS URL from an allowed image host.
```
Give requests to the image URL a 5-second timeout with AbortSignal.timeout(5_000).
Disable automatic redirects on requests to the image URL.
Reject responses with any 300-399 status code before reading their bodies by throwing a RemoteImagePreviewError with this message:
```
Image URL redirects are not allowed.
```
Return the parsed URL in the response, not the original image URL.

Run and submit the CLI tests from the project root.