Server-Side Request Forgery (ARCH5104)

Key go.security.ssrf · Severity warning · Category security · CWE CWE-918

Requesting a user-supplied URL without validation lets attackers force the server to reach internal services or cloud metadata endpoints.

Incorrect

func fetch(w http.ResponseWriter, r *http.Request) {
  url := r.URL.Query().Get("url")
  resp, _ := http.Get(url)
  io.Copy(w, resp.Body)
}

Correct

var allowedHosts = map[string]bool{"api.example.com": true}

func fetch(w http.ResponseWriter, r *http.Request) {
  u, err := url.Parse(r.URL.Query().Get("url"))
  if err != nil || !allowedHosts[u.Hostname()] {
    http.Error(w, "forbidden", 403)
    return
  }
  resp, _ := http.Get(u.String())
  io.Copy(w, resp.Body)
}

Fix

Validate outbound URLs against an allowlist; block private IP ranges and metadata endpoints.