How to Fix an SSRF Vulnerability in a URL Fetcher

What SSRF is and why it matters

Server-Side Request Forgery (SSRF) happens when a server fetches a URL chosen by the caller with no restrictions. A /fetch?url=... endpoint is the classic target. An attacker points it at http://127.0.0.1:8000/health to probe internal services, or at http://169.254.169.254/latest/meta-data/ to read cloud instance credentials - the server fetches it on their behalf, bypassing any network firewall.

Parsing and blocking internal destinations

Python's ipaddress module classifies addresses precisely. The pattern is to parse the URL, enforce a safe scheme, resolve the hostname, and reject the request if the target IP is in a private, loopback, or link-local range:

import socket
import ipaddress
from urllib.parse import urlparse

def _is_blocked(url):
    """Return True if the URL targets a loopback, private, or link-local address."""
    try:
        p = urlparse(url)
    except Exception:
        return True
    if p.scheme not in ("http", "https"):
        return True
    host = (p.hostname or "").lower()
    # Block by name before resolving.
    if host in ("localhost", "metadata.google.internal"):
        return True
    # IP literal: classify directly.
    try:
        ip = ipaddress.ip_address(host)
        return (ip.is_private or ip.is_loopback
                or ip.is_link_local or ip.is_reserved
                or ip.is_multicast)
    except ValueError:
        pass
    # Hostname: resolve and classify the resulting IP.
    try:
        ip = ipaddress.ip_address(socket.gethostbyname(host))
        return ip.is_private or ip.is_loopback or ip.is_link_local or ip.is_reserved
    except Exception:
        return False

Then guard the fetch endpoint:

@app.get("/fetch")
def fetch():
    url = request.args.get("url", "")
    if _is_blocked(url):
        return jsonify({"error": "blocked: refusing to fetch an internal address"}), 403
    resp = requests.get(url, timeout=3, allow_redirects=False)
    return jsonify({"status": resp.status_code, "body": resp.text[:2000]})

What each check covers

• Scheme check - http / https only; rejects file://, gopher://, etc.
• Name blocklist - catches localhost and metadata.google.internal before DNS.
• IP literal - ipaddress.ip_address() succeeds when the host is already dotted-decimal, and is_loopback / is_private / is_link_local classify it without a DNS round-trip.
• Hostname resolution - for non-literal hostnames, socket.gethostbyname() resolves to an IP and the same classification runs, blocking SSRF via DNS.

Limitations to know

allow_redirects=False matters: a redirect to http://127.0.0.1/ bypasses a one-time check. Without it, an attacker can redirect from a public URL to an internal one after your validation. Disable redirects entirely, or re-validate the Location header before following.

DNS rebinding is the other edge - a hostname resolves to a public IP at validation time, then to 127.0.0.1 by the time requests.get fires. A full defense resolves once, pins the IP, and connects to that IP directly with the Host header preserved. Blocking the obvious ranges is the essential first layer; egress firewall rules are the reliable backstop.