← Learn

Definition

What is SSRF (Server-Side Request Forgery)?

We scanned nearly 2,000 AI-built apps and 1 in 8 shipped a high-severity flaw. Want to check yours?Scan free →

Server-Side Request Forgery (SSRF) is when an attacker gets your server to make an HTTP request to a destination they control, often an internal address it would not normally reach. Because the request comes from inside your network, it can reach private services, admin panels, or cloud metadata endpoints that hold credentials.

How it happens

Any feature that fetches a user-supplied URL is a candidate: a link preview, a webhook, an image importer. If the code fetches whatever URL it is given, an attacker supplies an internal address such as the cloud metadata IP, and the server dutifully retrieves it and may return the contents.

How to prevent it

Resolve the target's DNS and reject anything that points to a private, loopback, or link-local address, and re-check on every redirect so a public host cannot rebind to an internal one. Allow only http and https on expected ports, and where possible use an allowlist of destinations.

What this means for AI-generated code

When an AI tool builds a fetch-this-URL feature, it writes the direct version that just requests the input, because that is all the feature needs to work. The address filtering that makes it safe is extra code with no visible payoff, so it is left out.

Want to know if your app has this issue? Scan a public repo free, no account needed.

Scan a repo →

Related: fix an SSRF-prone URL fetch

What Is SSRF (Server-Side Request Forgery)? Explained: Prbl