Server-side request forgery (ARCH7104)

Key php.security.ssrf · Severity warning · Category security · CWE CWE-918

Making an outbound request to a user-supplied URL without validation lets attackers force the server to reach internal services, cloud metadata endpoints, or local resources.

Incorrect

<?php
$url = $_GET['url'];
echo file_get_contents($url);

Correct

<?php
$url = $_GET['url'];
$host = parse_url($url, PHP_URL_HOST);
$allowed = ['api.partner.com', 'cdn.partner.com'];
if (!in_array($host, $allowed, true)) {
    http_response_code(400);
    exit;
}
echo file_get_contents($url);

Fix

Validate outbound request URLs against an allowlist; block private IP ranges and metadata endpoints.