---
title: Prevent Server-Side Request Forgery (SSRF)
impact: HIGH
impactDescription: prevents attackers from accessing internal resources or services
tags: security, ssrf, vulnerability, net-http
---

## Prevent Server-Side Request Forgery (SSRF)

Never allow users to provide the full URL or IP address for your server to fetch. Use an allow-list of domains or a secure proxy.

**Incorrect (unvalidated SSRF):**

```ruby
def fetch_external_report
  # Attacker url: http://localhost:5432 or http://169.254.169.254/metadata
  response = Net::HTTP.get(URI(params[:url]))
  render body: response
end
```

**Correct (validated domain):**

```ruby
ALLOWED_DOMAINS = ['trusted-report-source.com']

def fetch_external_report
  uri = URI(params[:url])
  if ALLOWED_DOMAINS.include?(uri.host)
    response = Net::HTTP.get(uri)
    render body: response
  else
    render_403
  end
end
```

**Tools:** Brakeman, ssrf_filter gem
---