Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesiTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
A server-side fetch() call can become a server-side request forgery (SSRF) vulnerability when a user can influence the destination. The danger is not that fetch() is inherently unsafe: it is that the server may be able to reach internal systems or restricted networks that the user cannot. Treat the destination, redirects, DNS resolution and actual connection as one security policy.
Can a user-supplied URL cause SSRF?
Yes. If an application accepts a URL and retrieves it from the server, an attacker may try to make that server contact internal resources or otherwise restricted destinations. The server makes the network request using its own access and privileges, so the request can cross boundaries that the person submitting the URL cannot cross directly. OWASP describes user-provided URLs and resource-fetching features as common contexts for SSRF.
This is specifically a risk of server-side fetching. A browser’s fetch() runs in the user’s browser and has different network access and security controls; it is not the same threat model. Nor is SSRF simply another name for cross-site request forgery (CSRF): SSRF concerns a server being induced to make a request to a destination chosen or influenced by an attacker.
How do I safely fetch a URL provided by a user?
First ask whether the feature needs arbitrary URLs at all. If it only needs to contact a small set of services, accept a destination identifier and map that identifier to a fixed, application-controlled destination. If users genuinely need to request public destinations, define a strict destination policy and ensure it governs the connection actually made—not merely the text originally submitted.
#1 Best Overall
Prefer a destination key or permitted host
Build the scheme, port and path from application-controlled values wherever the product permits. OWASP warns that complete URLs are difficult to validate and recommends allowlisting and constructing the request. As its SSRF Prevention Cheat Sheet puts it: “Do not accept complete URLs from the user because URL are difficult to validate and the parser can be abused depending on the technology used.”
If arbitrary public URLs are required
- Use a maintained URL parser, then make policy decisions from normalized parsed components rather than a raw string or regular expression.
- Allow only the schemes and ports the feature needs. Reject credentials and ambiguous input, and compare the parsed host against the product’s explicit destination policy.
- Resolve all relevant IPv4 and IPv6 addresses, then reject destinations that policy prohibits, including internal or otherwise restricted address ranges.
- Make the HTTP client connect only to an address that passed the policy. Preserve the original hostname for HTTP host handling and TLS verification where required.
- Apply the same policy to redirects, retries and fallback connections; bound request time and response size.
A parser, allowlist or DNS check on its own is not a guarantee of safety. The policy must fit the feature, and the client must not be able to silently connect somewhere different from the address that was checked.
Why is validating a URL before fetch not enough?
Validation of the submitted hostname does not necessarily determine where the eventual connection goes. DNS can return an address during validation and a different address when the HTTP client connects. This DNS rebinding or time-of-check/time-of-use gap can defeat a policy that checks a name but leaves the later lookup and connection uncontrolled. OWASP’s SSRF guidance discusses DNS rebinding and recommends binding the connection to an address that passed the checks.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →For that reason, the policy must cover the resolved IPv4 and IPv6 destinations and the connection itself. A hostname that appears permitted is not sufficient evidence that the server will connect to a permitted address.
How do redirects and DNS rebinding bypass URL checks?
Redirects change the destination
A permitted public URL can respond with a redirect to an internal or restricted target. If the HTTP client follows redirects automatically, checking only the first URL leaves the later request outside the original decision. Disable automatic redirect following, or validate each redirect destination before following it. OWASP and MDN both describe redirects as an SSRF concern; see the MDN SSRF overview and OWASP’s redirect guidance.
DNS can change between checks and connection
When validation and connection perform separate DNS lookups, the result can change between them. Resolve the host, evaluate the returned IPv4 and IPv6 addresses, and ensure the client connects to an approved address rather than resolving the name again without equivalent controls. Keep hostname-based HTTP and TLS behavior correct while pinning the network connection to the approved address.
Rank #4
String checks can misread URL structure
Raw substring tests and improvised regular expressions do not reliably express a policy about scheme, host, port and other parsed components. URL syntax can be ambiguous across parsers and technologies. Parse with a maintained implementation, reject forms the feature does not need, and validate the normalized components. OWASP’s SSRF entry in the 2021 Top 10 also cautions against relying on denylists and highlights redirect and DNS/TOCTOU risks; OWASP’s Unvalidated Redirects and Forwards Cheat Sheet explains parsed-component validation and safe destination selection.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWhich design choices reduce the risk?
These are design decisions, not interchangeable security products. The narrower the feature can make its destination scope, the less complicated its policy needs to be.
Best Value
- Comes with secure packaging
- It can be a gift item
- Easy to read text
| Decision | Safer default | If the feature needs more flexibility |
|---|---|---|
| Destination scope | Fixed server-side destinations | Explicitly permit only the external destinations the feature requires |
| Input shape | Destination ID or permitted host | Parse complete URLs with a maintained implementation and validate normalized components |
| Redirect policy | Reject redirects | Validate every redirect hop before following it |
| DNS and connection | Use a fixed destination | Check resolved IPv4 and IPv6 addresses and bind each connection to an address that passed policy |
| Network exposure | Restrict and isolate the fetching service’s egress | Keep outbound access constrained even when external destinations are allowed |
What should the fetching service be allowed to reach?
Validation is only one layer. Restrict the fetching component’s network access so it cannot freely reach sensitive internal services, and isolate it where possible. Give it only the privileges required for the feature, and log or monitor outbound requests so unexpected destinations and patterns can be investigated. MDN’s SSRF security overview and OWASP’s API7:2023 SSRF guidance address layered mitigations and the API context.
Also set suitable timeouts and response-size limits. These controls bound resource use; they do not replace destination validation or network restrictions.
Implementation checklist
- Remove arbitrary URLs if possible. Accept a destination key and construct the request from server-controlled values.
- Define permitted destinations. Specify allowed schemes, ports, hosts and address ranges for the feature.
- Parse, then validate. Use a maintained URL implementation, compare normalized components, and reject credentials or ambiguous forms the feature does not need.
- Control the connection. Resolve IPv4 and IPv6, reject prohibited addresses, and ensure the HTTP client connects only to an approved address.
- Control every hop. Disable redirects or repeat destination checks for every redirect, retry and fallback connection.
- Limit impact. Restrict egress and privileges, isolate the fetcher where possible, and set request and response limits.
- Observe outbound behavior. Log or monitor requests so violations and unexpected destination patterns are visible.
For API-specific context, OWASP defines the issue in its API7:2023 Server Side Request Forgery guidance. The central implementation rule remains the same: security decisions must constrain the destination the server actually contacts.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
