hardBackend

What is SSRF and how do you mitigate it in a Node.js backend?

Q: What is SSRF and how do you mitigate it in a Node.js backend?

**TL;DR.** **Server-Side Request Forgery** tricks your server into making requests to **attacker-chosen URLs** — often internal services, cloud **metadata** endpoints, or private IPs — using the server's trusted network position. Mitigate by **allowlisting** destinations, **resolving and blocking private IP ranges**, disabling redirects to new hosts, and isolating outbound access. user URL (untrusted) your server <path class='d-edge-dashed' d='M29

829 views

Understand the problem

Server-Side Request Forgery against internal services.

nodejssecurityssrfnetworking

Attempt it yourself

Sketch your approach before reading the solution — that's what interviews test.

Stuck? AI Nudge Available

Get a conceptual hint to guide your logic without spoiling the final implementation.

Study the solution

The solution is waiting

Give it an honest attempt first — then compare your thinking with the full walkthrough.

Read the code

Validate the resolved IP before fetching

import dns from 'node:dns/promises';
import net from 'node:net';

async function safeFetch(rawUrl) {
  const url = new URL(rawUrl);
  if (!['http:', 'https:'].includes(url.protocol)) throw new Error('bad scheme');
  const { address } = await dns.lookup(url.hostname);
  // reject private / loopback / link-local
  if (isPrivate(address)) throw new Error('blocked internal address');
  return fetch(url, { redirect: 'error' });   // no silent redirects
}

Join the discussion

Discussion (0)

No responses yet. Be the first to share what you think.

How do you implement microservices communication in Node.js?

What is the purpose of the HTTP Agent in Node.js?