ssrf-protection

Validate outbound HTTP requests to block SSRF and private network access.

Updated Mar 29, 2026

Search Tags:#security #redirects #ssrf #url-validation #http-client #outbound-requests #dns-rebinding

Ready to run

npx skills add https://github.com/marquesfelip/agents-and-skills --skill ssrf-protection

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: ssrf-protection
Source: https://github.com/marquesfelip/agents-and-skills/tree/main/skills/ssrf-protection
Command: npx skills add https://github.com/marquesfelip/agents-and-skills --skill ssrf-protection

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Outbound request validation and internal network protection to prevent server-side request forgery (SSRF) and related data exposure.

Core Features & Use Cases

URL allowlist and host validation to block unauthorized destinations
IP- and CIDR-based egress controls to prevent access to private metadata endpoints
DNS rebinding protection and strict scheme filtering (https/http only)
Safe HTTP client configuration with redirect validation and timeouts
Use cases: securing webhook handlers, content fetching proxies, and cloud-native services that fetch user-provided URLs

Quick Start

Configure outbound HTTP clients to enforce an https-only allowlist, validate redirects, and block private or metadata IP ranges.

Frequently Asked Questions about ssrf-protection

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I prevent SSRF attacks when my API fetches user-provided URLs?▼

Preventing SSRF attacks requires validating outbound requests by enforcing URL scheme restrictions, host allowlisting, and blocking private IP ranges. This shields internal networks from unauthorized querying when APIs fetch user-provided URLs.

What is DNS rebinding protection and how does it secure outbound HTTP requests?▼

DNS rebinding protection secures outbound HTTP requests by ensuring the resolved IP address of a domain matches the initially validated address. This prevents attackers from bypassing IP egress controls to access internal metadata endpoints.

How do I configure a safe HTTP client to block private IP ranges and validate redirects?▼

Configuring a safe HTTP client involves setting strict timeouts, blocking egress to private CIDR ranges, and validating all redirect destinations. This ensures outbound requests cannot be silently rerouted to restricted internal networks.

Can I use URL allowlisting to secure webhook handlers and content fetching proxies?▼

Yes, you can secure webhook handlers and content fetching proxies by applying URL allowlisting and strict scheme filtering. Restricting egress to https-only destinations prevents unauthorized access to internal services and cloud metadata endpoints.

What are the best ways to protect cloud-native workloads from SSRF vulnerabilities?▼

Protecting cloud-native workloads from SSRF vulnerabilities requires implementing IP-based egress controls, DNS rebinding protection, and cloud-specific mitigations. These measures block malicious requests targeting cloud metadata endpoints.