SSRF

What it means

SSRF stands for server-side request forgery. Your application takes a URL, or something it builds a URL from, and fetches it. An attacker supplies an address of their choosing and your server goes and gets it for them.

The target is usually internal: an admin service, a cloud metadata endpoint, a database console, something nobody meant to expose.

Why it matters

The request carries your server's trust. Internal services often skip authentication because they assume anything calling them is already inside, and your application is inside.

That turns a small feature, fetching a preview or an avatar, into a way to read internal systems from the public internet. It frequently leads to credentials, because cloud platforms hand them out at addresses only local callers should reach. Teams also tend to find it late, because nobody thinks of a link preview as a way for a stranger to make requests inside your network.

How it shows up

Look for any feature that accepts a URL: webhook targets, image imports from a link, document converters, link previews, anything that says paste a URL here.

Blocking a list of bad addresses does not hold, because redirects and unusual address formats get around it. An allowed list of destinations, resolved before the request goes out, holds better, and a service that cannot reach your internal network at all holds best. Watch the response as well. An application that shows fetched content back to the user hands over the answer directly. One that only differs in response time still tells an attacker which internal hosts reply. Log the outbound requests your application makes. Most teams cannot say what their own servers fetched yesterday.