ssrf-prevention

• SKILL.mdcore · 6,543 bytes
• SKILL.mdcore · 6,543 bytes
• metadata.jsonasset · 1,464 bytes
• references/metadata-and-egress.mddoc · 6,549 bytes
• references/verifying-findings.mddoc · 2,537 bytes

<!-- Native skill bundle for agent-skills (cross-tool convention). Generated by `secure-vibe dev regenerate`. -->
<!-- Do not edit by hand; the source of truth is skills/ssrf-prevention/SKILL.md. -->

# SSRF Prevention

Server-Side Request Forgery: allowlisting the destination of a server-side fetch, when re-resolution between check and connect matters, redirect and scheme bypasses, parsers that fetch on their own (XXE, SVG, HTML-to-PDF), cloud metadata, and keeping the response from becoming an oracle. Use when fetching a client-supplied URL, wiring webhooks, image proxies, PDF or preview renderers, or reviewing any HTTP-client wrapper.

## ALWAYS

- Constrain the destination with an **allowlist of hosts you intend to reach**, not a denylist of addresses you intend to avoid. A denylist has to enumerate every spelling of every internal address — decimal and octal IPv4, IPv6 and IPv4-mapped IPv6, a hostname whose A record is private, a public wildcard resolver like `nip.io` that encodes any address into a name — and it only has to be wrong once.
- Know which of the two controls you built, because it decides whether re-resolution matters. An **allowlist of hostnames** survives DNS rebinding: the attacker controls DNS only for names they own, and those names are not on the list. An **IP-range check** does not: the name resolves to a public address when you validate and a private one when you connect, and the two resolutions are independent. If your control is address-based, resolve once and **connect to that pinned address** — a custom dialer or transport, carrying the original hostname for SNI and `Host` — so no second lookup can occur.
- Re-validate **at every redirect hop**, or disable redirect-following entirely on fetchers that take user-supplied URLs. An allowed host answering `302` to `http://169.254.169.254/` is the single most common bypass, and it defeats a check performed only on the URL the user submitted.
- Restrict the scheme to `http` and `https` before anything else. `file://`, `gopher://`, `dict://`, `ldap://`, `jar://` and friends turn a fetcher into a file reader or a protocol-smuggling primitive.
- Keep the **user-URL fetcher and the internal fetcher as separate clients**, and make mixing them fail to compile rather than fail at runtime — distinct types in Go, Rust or TypeScript. A single client used for both eventually gets called with the wrong argument.