Server-side request forgery (ARCH331)

Key dotnet.security.ssrf · Severity warning · Category security · CWE CWE-918

Making an outbound request to a user-supplied URL without validation lets attackers force the server to reach internal services, cloud metadata endpoints, or local resources.

Incorrect

public async Task<IActionResult> Fetch(string url)
{
    var data = await _http.GetStringAsync(url);
    return Content(data);
}

Correct

public async Task<IActionResult> Fetch(string url)
{
    if (!Uri.TryCreate(url, UriKind.Absolute, out var uri) ||
        !_allowedHosts.Contains(uri.Host))
        return BadRequest();

    var data = await _http.GetStringAsync(uri);
    return Content(data);
}

Fix

Validate outbound request URLs against an allowlist; block private IP ranges and metadata endpoints.