SSRF prevention on outbound requests

Server-side request forgery (CWE-918, OWASP A10 Server-Side Request Forgery) lets attackers weaponize your application's outbound HTTP client to probe or attack internal services — cloud metadata endpoints (169.254.169.254), internal databases, and private admin APIs that are not exposed to the internet. Any endpoint that fetches a user-supplied URL without validation is an SSRF vector. NIST 800-53 SI-10 requires input validation on all externally supplied values. In cloud environments, SSRF against the EC2 metadata endpoint can yield IAM credentials, giving an attacker full AWS account access.

Resolve the hostname and validate the IP before making any outbound request to a user-supplied URL:

import dns from 'dns/promises'
import { isPrivateIp } from 'private-ip'

async function safeFetch(userUrl: string): Promise<Response> {
  const parsed = new URL(userUrl)  // throws on invalid URL
  if (!['http:', 'https:'].includes(parsed.protocol)) {
    throw new Error('Only HTTP/HTTPS allowed')
  }
  const addresses = await dns.resolve4(parsed.hostname).catch(() => [])
  for (const addr of addresses) {
    if (isPrivateIp(addr)) throw new Error('Private IP addresses are blocked')
  }
  return fetch(userUrl)
}

For webhook URL registration, prefer an explicit domain allowlist over blocklist logic — allowlists are easier to reason about and don't require enumerating all private ranges.