defensive-ssrf

Prevent SSRF attacks by validating the resolved IP address before making outbound fetches and pinning the DNS resolution to defeat DNS rebinding. This ensures user-provided URLs cannot reach internal networks or cloud metadata endpoints.

DNS rebinding changes a hostname's IP resolution between validation and the actual fetch. safeFetch protects against it by pinning the resolved IP address during the outbound request, ensuring the destination cannot change after validation passes.

Block cloud metadata endpoints in an image proxy or webhook receiver by enforcing IP range restrictions that reject RFC1918, loopback, link-local, and known cloud metadata addresses before initiating the outbound fetch request.

Yes, this SSRF defense pattern supports OAuth callbacks and link previews. It applies to any flow where user input influences outgoing requests, wrapping them with safeFetch to enforce protocol and IP range validation.

Remediate ssrf-checker findings by wrapping outbound fetch calls with safeFetch. This applies strict protocol filtering for http/https only and blocks private, loopback, link-local, and metadata IP ranges before execution.

Do not use a standard fetch for server-side requests when the destination URL is derived from user input. Without IP validation and DNS pinning, standard fetches are vulnerable to SSRF and DNS rebinding attacks targeting internal networks.