SSRF Protection Expert

Server-Side Request Forgery (SSRF) Prevention

Focus: URL Validation, Allowlisting, Network Segmentation
Stack: Python (urllib/ipaddress), TypeScript (URL API)

Overview

Comprehensive defense strategies against SSRF attacks where an attacker induces the server to make requests to unintended locations.

Core Defense Layers

1. Input Validation: Strict allowlisting of domains and protocols.
2. Network Layer: Blocking access to internal/private IP ranges (10.0.0.0/8, 127.0.0.1, etc.).
3. Application Layer: Disabling redirects, validating response types.
4. Infrastructure: Running services in isolated network environments.

Implementation Patterns

1. Robust URL Validator (Python)

Validates URLs against allowlists and blocks private IP ranges (including DNS rebinding protection).

import socket
import ipaddress
from urllib.parse import urlparse

class SSRFValidator:
    def __init__(self, allowed_domains=None):
        self.allowed_domains = allowed_domains or []
        self.blocked_networks = [
            ipaddress.ip_network('10.0.0.0/8'),
            ipaddress.ip_network('172.16.0.0/12'),
            ipaddress.ip_network('192.168.0.0/16'),
            ipaddress.ip_network('127.0.0.0/8'),
            ipaddress.ip_network('169.254.0.0/16'), # Cloud metadata
        ]

    def validate(self, url: str) -> bool:
        try:
            parsed = urlparse(url)

            # 1. Protocol Check
            if parsed.scheme not in ('http', 'https'):
                return False

            # 2. Domain Allowlist Check
            if self.allowed_domains and parsed.hostname not in self.allowed_domains:
                return False

            # 3. DNS Resolution & IP Check (Anti-DNS Rebinding)
            # Note: In production, use the resolved IP for the actual request
            ip_str = socket.gethostbyname(parsed.hostname)
            ip_addr = ipaddress.ip_address(ip_str)

            for network in self.blocked_networks:
                if ip_addr in network:
                    return False

            return True
        except Exception:
            return False

# Usage
validator = SSRFValidator(allowed_domains=['api.example.com', 'google.com'])
is_safe = validator.validate("https://169.254.169.254/latest/meta-data/") # False

2. Secure HTTP Client (Python)

Making requests safely using the validation logic.

import requests
from requests.adapters import HTTPAdapter

class SecureClient:
    def __init__(self, validator):
        self.validator = validator
        self.session = requests.Session()
        self.session.mount('https://', HTTPAdapter(max_retries=3))

    def get(self, url: str, **kwargs):
        # 1. Validate URL first
        if not self.validator.validate(url):
            raise ValueError(f"Blocked potentially unsafe URL: {url}")

        # 2. Disable redirects to prevent open redirect bypasses
        kwargs['allow_redirects'] = False

        # 3. Set reasonable timeout
        kwargs.setdefault('timeout', 5.0)

        return self.session.get(url, **kwargs)

3. Network Segmentation (Infrastructure)

Ensure the application server cannot route to sensitive internal services.

AWS Security Group (Outbound Rules):

• Allow: 0.0.0.0/0 (Internet) on port 80/443
• Deny: 10.0.0.0/8 (VPC Internal)
• Deny: 169.254.169.254/32 (Instance Metadata)

Docker Network:

services:
  app:
    networks:
      - public_net
    # Isolate from internal services

networks:
  public_net:
    internal: false

Security Best Practices

1. Allowlist over Blocklist: Always prefer explicitly allowing known good domains over trying to block bad ones.
2. Disable Redirects: Attackers often use open redirects on trusted domains to bypass filters.
3. Validate Response: Check Content-Type and response size to prevent DoS or unexpected parsing.
4. Use Dedicated Parsers: Don't use regex for URL parsing; use standard libraries (urllib, URL).

Validation Checklist

• Protocols: Only http and https allowed? (No file://, gopher://)
• Internal IPs: 127.0.0.1, 10.x.x.x, 192.168.x.x blocked?
• Cloud Metadata: 169.254.169.254 blocked?
• Redirects: Disabled or strictly validated?
• DNS: Resolved IP checked against blocklist?

Related Skills

• moai-security-devsecops: Security testing
• moai-cloud-aws-advanced: AWS network security
• moai-security-encryption: Secure communication

Last Updated: 2025-11-20