https://nalar.dev/tags/web-security/ Recent content in Web Security on Nalar Hugo en-us Tue, 01 Sep 2026 00:00:00 +0700 https://nalar.dev/prevent-ssrf-backend-services/ Tue, 01 Sep 2026 00:00:00 +0700 https://nalar.dev/prevent-ssrf-backend-services/ <p>Features that fetch a URL supplied by a user appear in webhook testers, image importers, link previewers, document converters, and integration platforms. They also create a server-side request forgery (SSRF) boundary: an attacker can try to make the backend send requests to destinations the attacker cannot reach directly.</p> <p>A secure design needs more than a blacklist of suspicious strings.</p> <h2 id="understand-the-trust-boundary">Understand the trust boundary</h2> <p>The dangerous capability is not URL parsing itself. It is allowing untrusted input to influence a network connection made with the server&rsquo;s network identity.</p>