server-side request forgery
Server-side request forgery causes a server to contact an unintended destination.
Use this when A server downloads content from URLs supplied by users.
without the term
“We have a 'fetch link preview' feature that downloads any URL the user gives. Could someone use it to reach our internal services or cloud metadata? Can you lock it down?”
with the term · How do you ask a model for server-side request forgery?
Restrict this URL-fetching feature to its intended destinations. Test internal addresses, redirects, and DNS changes without allowing arbitrary internal access.
What is server-side request forgery?
A feature that fetches a user-supplied URL, such as a link preview or import, can be pointed at internal addresses like 169.254.169.254 or localhost, directly or through redirects.
Why does server-side request forgery matter when vibe coding?
A URL-shaped string can target internal services or redirect to them.
How do you do server-side request forgery?
Constrain destinations and protocols, validate redirect targets, and enforce network-level egress restrictions where possible.
What goes wrong with server-side request forgery?
Checking only the submitted hostname while the eventual connection reaches another address.