BigHugger
sk Skill · ShieldNet-360

ssrf-prevention

Server-Side Request Forgery: allowlisting the destination of a server-side fetch, when re-resolution between check and connect matters, redirect and scheme bypasses, parsers that fetch on their own (XXE, SVG, HTML-to-PDF), cloud metadata, and keeping the response from becoming an oracle. Use when fetching a client-supplied URL, wiring webhooks, image proxies, PDF or preview renderers, or reviewing any HTTP-client…

installs 8w
0
30-day movement
starts with the next reading
Related entries
1
Connections
0
Goprevention
Host repository
ShieldNet-360/secure-vibe
Category
prevention
Version
2.0.0
Compatible with
when generating code that fetches a URL supplied or influenced by a client, when wiring webhooks, image proxies, PDF renderers, link previews, oEmbed fetchers, when parsing user-supplied XML, SVG, HTML, or Markdown that a renderer may resolve, when running in a cloud environment with an instance metadata service, when reviewing a URL-parsing or HTTP-client wrapper
Host stars
22
Host language
Go