thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Application & OT Security · Intermediate

SSRF Prevention

Defenses that stop an application from being used to send requests to unintended internal or external destinations.

Definition

Key controls are allowlisting destination hosts and schemes, resolving and validating the IP after DNS resolution (to defeat DNS rebinding), blocking private, loopback and link-local ranges, disabling redirects, network egress filtering and requiring IMDSv2 on cloud instances. Denylists of 'localhost' strings are easily bypassed.

Example

An image-import feature only fetches from an allowlisted set of HTTPS domains and runs in a subnet with no route to internal services.

Exam tip

Network segmentation plus allowlisting beats string denylists; IMDSv2 limits cloud credential theft.

Related terms