skills.rest
marquesfelip
marquesfelipCOMMUNITY
Explore all skills by this author →
GitHub

ssrf-protection

Validate outbound HTTP requests to block SSRF and private network access.

Updated Mar 29, 2026
Search Tags:#security#redirects#ssrf#url-validation#http-client#outbound-requests#dns-rebinding
One-click install
npx skills add https://github.com/marquesfelip/agents-and-skills --skill ssrf-protection
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: ssrf-protection
Source: https://github.com/marquesfelip/agents-and-skills/tree/main/skills/ssrf-protection
Command: npx skills add https://github.com/marquesfelip/agents-and-skills --skill ssrf-protection

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Outbound request validation and internal network protection to prevent server-side request forgery (SSRF) and related data exposure.

Core Features & Use Cases

  • URL allowlist and host validation to block unauthorized destinations
  • IP- and CIDR-based egress controls to prevent access to private metadata endpoints
  • DNS rebinding protection and strict scheme filtering (https/http only)
  • Safe HTTP client configuration with redirect validation and timeouts
  • Use cases: securing webhook handlers, content fetching proxies, and cloud-native services that fetch user-provided URLs

Quick Start

Configure outbound HTTP clients to enforce an https-only allowlist, validate redirects, and block private or metadata IP ranges.

Frequently Asked Questions about ssrf-protection

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I prevent SSRF attacks when my API fetches user-provided URLs?▼

Preventing SSRF attacks requires validating outbound requests by enforcing URL scheme restrictions, host allowlisting, and blocking private IP ranges. This shields internal networks from unauthorized querying when APIs fetch user-provided URLs.

What is DNS rebinding protection and how does it secure outbound HTTP requests?▼

DNS rebinding protection secures outbound HTTP requests by ensuring the resolved IP address of a domain matches the initially validated address. This prevents attackers from bypassing IP egress controls to access internal metadata endpoints.

How do I configure a safe HTTP client to block private IP ranges and validate redirects?▼

Configuring a safe HTTP client involves setting strict timeouts, blocking egress to private CIDR ranges, and validating all redirect destinations. This ensures outbound requests cannot be silently rerouted to restricted internal networks.

Can I use URL allowlisting to secure webhook handlers and content fetching proxies?▼

Yes, you can secure webhook handlers and content fetching proxies by applying URL allowlisting and strict scheme filtering. Restricting egress to https-only destinations prevents unauthorized access to internal services and cloud metadata endpoints.

What are the best ways to protect cloud-native workloads from SSRF vulnerabilities?▼

Protecting cloud-native workloads from SSRF vulnerabilities requires implementing IP-based egress controls, DNS rebinding protection, and cloud-specific mitigations. These measures block malicious requests targeting cloud metadata endpoints.

Related Skills

Explore More Software Engineering Skills→
thejefflarsonthejefflarson
20

ssrf

Detect and remediate SSRF vulnerabilities in outbound HTTP requests.

Community
Advanced
augustoheissaugustoheiss

agency-security-engineer

Identify and remediate application security risks in web and cloud-native systems.

Community
Advanced
lapc506lapc506
4

Network Policies & Security

Manage Kubernetes network policies with ingress and egress rules.

Community
Advanced
devtintdevtint

waf-bypass

Identify and bypass Web Application Firewalls during API penetration testing.

Community
Intermediate