Group
  • Security

    Prevent SSRF in features that fetch URLs

    Validates and restricts any server-side fetching of user-supplied URLs so internal services stay unreachable.

    • Improve quality
    • Debug & fix
    • Advanced
    • General

Free Prompt

Audit my app for server-side request forgery (SSRF) risks. Find every feature where the server fetches a URL that comes from user input: URL preview generators, webhook testers, image fetchers, import-from-URL, RSS readers, avatar-from-URL. For each one: parse and validate the URL, require https (and http only if genuinely needed), resolve the hostname and reject private, loopback, link-local, and metadata IP ranges (127.0.0.0/8, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 169.254.0.0/16, ::1, and cloud metadata addresses). Re-check after redirects, since a safe URL can redirect to an internal one; either disable redirects or validate each hop. Set a response size cap and a timeout. Prefer an allowlist of known domains where the feature permits it. Do not remove the feature. If validation needs a DNS resolution step, use my runtime's resolver rather than string-matching IP patterns (hostnames like 2130706433 or decimal/hex IP encodings bypass naive checks). Show me each fetch point and the protection added. Give me test cases: a URL pointing at 169.254.169.254 (cloud metadata), one at 127.0.0.1, an encoded IP variant, and a legitimate URL, with the first three refused.

What This Does / How This Helps

Locks down every feature where your server fetches a user-supplied URL, so it can't be turned into a proxy for your internal network. SSRF is how attackers reach things the internet can't: your database admin panel, cloud metadata endpoints that hand out credentials, internal APIs. Any feature that fetches a URL the user typed is a candidate, and vibe-coded apps ship URL preview and import features with zero validation. The prompt handles the bypasses that beat naive fixes: redirects to internal addresses, weird IP encodings, and decimal hostnames. You get attack-style test cases to prove each one is refused.

Want to skip doing this by hand?

Fortivibe audits your app for all of the areas these prompts cover (and more).

See What We Check

Related Prompts