Requests, files, and servers
Control server-side requests
Prevent SSRF by restricting destinations, protocols, redirects, DNS behavior, credentials, and response sizes for server-side fetch features.
8 minute lesson
A server-side fetch can reach networks and credentials the user cannot. A URL input may therefore become a path into your infrastructure.
Prefer fixed provider endpoints. Otherwise allowlist schemes and destinations, resolve and validate addresses, block private and metadata ranges, control redirects, limit time and bytes, and use an isolated client without ambient credentials. Recheck after DNS resolution.
An image importer accepts a public URL that redirects to http://169.254.169.254. The first host passes validation, but the server follows the redirect into cloud metadata.
A DNS name can also resolve differently after an initial check. Validate the resolved destination used for each connection and cap redirects, time, and response bytes.
Test the fetcher with a public image, loopback, a private address, a metadata address, and a redirect to each blocked range. Capture the destination decision and prove the client sends no ambient credential.
Lesson completed