Back to feed
Dev.to
Dev.to
7/15/2026
The original headline is: "Your URL-fetching service is an SSRF engine - here's the two-layer guard we shipped"

The original headline is: "Your URL-fetching service is an SSRF engine - here's the two-layer guard we shipped"

Original: Your URL-fetching service is an SSRF engine - here's the two-layer guard we shipped

Short summary

Any service that fetches user-supplied URLs server-side is an SSRF engine. This article details a two-layer guard: pre-navigation IP classification across all blocked CIDR ranges (including IPv6-mapped IPv4), and per-request checks via Playwright route handlers to catch DNS rebinding at connect time. The shared security core is kept byte-for-byte identical across two repos via CI enforcement.

  • •Two-layer SSRF defense: pre-navigation IP classification plus per-request Playwright route checks
  • •Covers IPv4 CIDR ranges, IPv6-mapped IPv4, and DNS rebinding attacks
  • •Shared security core enforced as byte-identical across two repos via CI

Generated with AI, which can make mistakes.

#ai-tools
Read full article at Dev.to

Is this a good recommendation for you?

Comments

Failed to load comments. Please try again.

Explore more

Reproducing a Roundcube SSRF vulnerability: how an email can trigger internal network requests
Dev.to
Why Cursor's CORS Fix Opens Your API to Any Website (CWE-942)
Dev.to
The original title is "AI Agent Egress Proxy: Stop Tool Calls From Leaking Data"
Dev.to
I shipped an unauthenticated RCE in my own port scanner — here's the whole chain, and how I killed it
Dev.to