Server-side request forgery (ARCH3104)

Key typescript.security.ssrf · Severity warning · Category security · CWE CWE-918

Making an outbound request to a user-supplied URL without validation lets attackers force the server to reach internal services or cloud metadata endpoints.

Incorrect

app.get("/proxy", async (req, res) => {
  // url="http://169.254.169.254/latest/meta-data"
  const r = await fetch(req.query.url as string);
  res.send(await r.text());
});

Correct

const allowedHosts = new Set(["api.example.com"]);

app.get("/proxy", async (req, res) => {
  const u = new URL(req.query.url as string);
  if (!allowedHosts.has(u.hostname)) return res.status(400).end();
  const r = await fetch(u);
  res.send(await r.text());
});

Fix

Validate outbound request URLs against an allowlist; block private IP ranges and metadata endpoints.