138
server-side request forgery
also SSRF
The server fetches a URL the user supplied. That URL can be your metadata service or localhost.
What is server-side request forgery?
SSRF is the server making a request an attacker chose. Webhooks, image proxies, “import from URL,” and PDF renderers are classic. Cloud metadata IPs and internal admin ports answer the server even when they would never answer the user.
Why does server-side request forgery matter when vibe coding?
Models add “paste a URL and we will fetch it” with no allowlist. Name the fetch policy or the next feature is an open proxy.
How do you do server-side request forgery?
Allowlist hosts or schemes. Block link-local, localhost, and metadata addresses. Do not follow redirects to those. Resolve DNS and check the IP before connecting.
How do you ask a model for server-side request forgery?
The server fetches a user-supplied URL. Allowlist hosts. Refuse localhost, link-local, and cloud metadata IPs. Re-check after redirects. Do not proxy arbitrary URLs.
What goes wrong with server-side request forgery?
Blocking the string “localhost” and allowing `127.0.0.1` or a redirect to it. Check the address you actually connect to.