Skip to main content
All glossary terms

Credentials & security

Server-side request forgery (SSRF)

Server-side request forgery (SSRF) is a vulnerability in which an application can be induced to make a network request chosen or influenced by an attacker. The risk depends on what destinations the server can reach, what response data is exposed, and what authority the application carries.

Also known as SSRF.

Why it matters in practice

Defenses often combine strict destination validation, network segmentation, safe URL handling, and controls over redirects and name resolution. A proxy or egress filter can contribute only when the application’s traffic reliably passes through it and rules cover the relevant cases. No single generic filter should be described as complete SSRF protection.

Example

A server accepts a user-supplied URL, so its team tests whether a request to an unintended address can be made through the normal application path.

Educational note

This definition is general information, not legal advice. It may omit facts that matter to a specific situation and does not establish or guarantee compliance.