Server-side request forgery (ARCH2104)

Key python.security.ssrf · Severity warning · Category security · CWE CWE-918

Making an outbound request to a user-controlled URL without validation lets an attacker force the server to hit internal services or cloud metadata endpoints.

Incorrect

import requests
from flask import request

def fetch():
    url = request.args["url"]
    return requests.get(url).text

Correct

import requests
from urllib.parse import urlparse
from flask import request

ALLOWED = {"api.example.com"}

def fetch():
    url = request.args["url"]
    if urlparse(url).hostname not in ALLOWED:
        raise ValueError("host not allowed")
    return requests.get(url).text

Fix

Validate outbound URLs against an allowlist; block private IP ranges and metadata endpoints.