Tech teamRunning a website or small org
Server-side request forgery (SSRF)
Tricking your own server into fetching what it should not.
Understand it
If your app fetches a web address a user supplies, an attacker may aim it at your internal systems or cloud settings - making your server reveal secrets it can reach but they cannot.
How to spot it
On your own app: features that fetch a URL, import from a link, or load a remote image on request.
Close the gap
- Validate and allow-list the addresses your server may fetch.
- Block requests to internal and cloud-metadata addresses.
- Fetch with least privilege, on an isolated path.
- Treat any user-supplied address as hostile.
What to do about it
This sits with whoever builds and runs your website or systems - it’s beyond what a personal plan should promise to fix. If that’s not you, hand it to whoever looks after your security. We’d rather be honest about where we stop.
Your own accounts and devices are still worth protecting; your plan covers those.