Server-side request forgery (SSRF)
SSRF makes an application send unwanted network requests from its server. What matters is which destinations the server actually reaches.
Server-side request forgery, or SSRF, means abusing an application to make its server send requests to unintended destinations. The server may have different network access from the person providing input. This can, for example, allow access to internal services that are not directly reachable from outside.
A document preview with an externally supplied destination
A fictional project portal fetches a document for preview from the address in the previewTarget field. If that address is used without appropriate checks, the preview feature can become an intermediary for unwanted access. The problem here lies in the server's fetch, before the document is displayed. Such requests can have unwanted effects even when the response content is not returned.
In this portal variant, previews are intended only for known document sources. The application can therefore fix the permitted sources instead of accepting arbitrary destinations. This restriction fits only if the feature can actually be limited to known sources.
Consider destination checks and network boundaries together
MDN and OWASP describe protection at application and network levels. Checking only the written hostname is insufficient: resolved destination addresses and the actual connection must also satisfy the permitted destination policy. Redirects can change the destination and must not bypass the checks.
The service also needs only the network access required for its task. Protocol and destination restrictions, controlled redirects and limited network privileges work together. HTTPS alone does not make a destination permitted. The portal scenario explains the trust boundary; it is not a report of a fetch or security test being performed.
Sources
Related terms
- APIAn API defines how software can use functions or data offered by other software.
- BackendThe backend handles an application’s server-side rules and data. It is more than a database or an administration screen.
- WebhookA webhook sends an HTTP notification to another system when a specified event occurs.
- Data minimisationData minimisation limits personal data to what is adequate, relevant and necessary for a defined purpose.
- Data retention policyA data retention policy defines the purpose, start, duration and end of storage. Deletion jobs and copies must be addressed in the implementation.
- Envelope encryptionEnvelope encryption separates the data key from the key protecting it. The encrypted file and wrapped data key need to be managed together.
Your project with ASES
Describe your project to us. We will get back to you with an initial assessment.