security-review-owasp-server-side-request-forgery-prevention

Reviewing for SSRF involves checking outbound request flows in webhook senders and callback handlers for proper URL parsing, allowlist enforcement, DNS validation, and redirect restrictions to block access to private networks and cloud metadata endpoints.

SSRF prevention restricts user-influenced outbound requests from reaching unintended targets. DNS validation acts as a bypass mitigation by verifying resolved IP addresses against blocklists, ensuring attackers cannot use DNS rebinding to access private or metadata endpoints.

Yes, it can audit proxy flows and URL fetchers. It checks redirect handling to ensure followed URLs are revalidated against allowlists, preventing bypasses where an initial safe destination redirects to private networks or metadata services.

Check for cloud metadata exposure by reviewing outbound request logic for strict network-layer protections. Ensure URL handling and DNS resolution block access to metadata endpoints, and verify that redirect handling cannot be bypassed to reach them.

Validating parser output for SSRF protection requires verifying parsed URL components against strict allowlists or blocklists. This confirms the destination selection process cannot be manipulated to bypass network-layer protections and reach private targets.

Audit DNS resolution whenever user input influences destination selection in webhook targets or fetchers. This verifies that DNS resolution cannot be manipulated via rebinding to bypass blocklists and reach private networks or metadata endpoints.