The curious link preview
Your app shows a preview card when someone pastes a link. A user pasted an odd address, and the preview showed your server's cloud credentials.
This answers: What is SSRF in a link preview feature? No coding needed. 3 quick decisions.
- How a request travels
- Keys and secrets
Checking your access…
What is SSRF in a link preview feature?
Server-side request forgery happens when your server fetches a URL a visitor provides, and the visitor points it at internal addresses such as , private networks or the cloud metadata address 169.254.169.254. Allow only http and https, resolve the address and refuse internal ranges, limit redirects, time and size, and return only the title and image.
Breaks at Your server: Server fetched an internal address
Why AI tools write this bug
Generated preview code fetches the URL and returns the response, and tests only try normal public URLs, so internal addresses are never considered.
How to fix it
- Allow only http and https URLs.
3 more steps, and a prompt that checks your own app for this bug. Part of Pro.
UnlockCommon questions
- Is blocking '169.254' in the URL enough?
- No. Domains can resolve to internal addresses, addresses have other spellings, and safe URLs can redirect inside. Check the resolved address.