[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"doc-seo-571638-105":3,"detail-sidebar-cat-1-en-105":81,"doc-detail-571638-en":126},{"code":4,"msg":5,"data":6},0,"ok",{"site_id":7,"language":8,"slug":9,"title":10,"keywords":11,"description":12,"schema_data":13,"social_meta":74,"head_meta":76,"extra_data":78,"updated_unix":80},105,"en","preventing-server-side-request-forgery-attacks-a-novel-defense-approach","Preventing Server-Side Request Forgery Attacks - A Novel Defense Approach","","Web applications that accept URLs from users can be tricked into connecting to internal services, enabling Server-Side Request Forgery (SSRF). These attacks become especially dangerous in cloud-hosted deployments, where exploitation is easier and impacts internal systems. The work analyzes over 60 SSRF vulnerability reports, showing limited developer awareness and common defensive flaws or security and functionality limitations. It proposes a systematic defense approach, implemented via an extended reverse proxy prototype, and demonstrates effective SSRF prevention with minimal performance loss.",{"@graph":14,"@context":73},[15,34,56],{"@type":16,"itemListElement":17},"BreadcrumbList",[18,23,27,31],{"item":19,"name":20,"@type":21,"position":22},"https://docshare.wps.com","Home","ListItem",1,{"item":24,"name":25,"@type":21,"position":26},"https://docshare.wps.com/template/","Template",2,{"item":28,"name":29,"@type":21,"position":30},"https://docshare.wps.com/template/presentations/","Presentations",3,{"item":32,"name":10,"@type":21,"position":33},"https://docshare.wps.com/template/preventing-server-side-request-forgery-attacks-a-novel-defense-approach/571638/",4,{"url":32,"name":10,"@type":35,"image":36,"author":41,"headline":10,"publisher":44,"fileFormat":47,"inLanguage":8,"description":12,"dateModified":48,"datePublished":49,"encodingFormat":47,"isAccessibleForFree":50,"interactionStatistic":51},"DigitalDocument",{"url":37,"@type":38,"width":39,"height":40},"https://docshare.wps.com/thumbnails/preventing-server-side-request-forgery-attacks-a-novel-defense-approach/571638.png","ImageObject",442,249,{"name":42,"@type":43},"noah","Person",{"url":19,"name":45,"@type":46},"DocShare","Organization","application/pdf","2026-10-23","2026-10-13",true,{"@type":52,"interactionType":53,"userInteractionCount":55},"InteractionCounter",{"@type":54},"ViewAction",5,{"@type":57,"mainEntity":58},"FAQPage",[59,65,69],{"name":60,"@type":61,"acceptedAnswer":62},"Why are SSRF attacks dangerous for internal services?","Question",{"text":63,"@type":64},"If a web application opens a connection to a user-supplied URL that targets an internal service, the server can expose local services to a remote attacker, making the trust relationship exploitable.","Answer",{"name":66,"@type":61,"acceptedAnswer":67},"What does the paper propose to defend against SSRF?",{"text":68,"@type":64},"It presents a novel defense approach that protects internal services from SSRF by developing a prototype that extends a popular reverse proxy and deploying vulnerable web applications using it.",{"name":70,"@type":61,"acceptedAnswer":71},"How do the authors evaluate the effectiveness of the defense?",{"text":72,"@type":64},"The paper demonstrates that SSRF attacks on the deployed applications can be prevented with almost no loss of performance.","https://schema.org",{"og:url":32,"og:type":75,"og:title":10,"og:site_name":45,"og:description":12},"article",{"robots":77,"canonical":32},"index,follow",{"doc_id":79,"site_id":7},571638,1792244903,{"code":4,"msg":82,"data":83},"success",[84,88,93,98,103,108,113,118,122],{"id":85,"doc_module":22,"doc_module_name":25,"category_name":29,"show_sort_weight":86,"slug":87},11,90,"presentations",{"id":89,"doc_module":22,"doc_module_name":25,"category_name":90,"show_sort_weight":91,"slug":92},12,"Resumes",80,"resumes",{"id":94,"doc_module":22,"doc_module_name":25,"category_name":95,"show_sort_weight":96,"slug":97},14,"Invoices",70,"invoices",{"id":99,"doc_module":22,"doc_module_name":25,"category_name":100,"show_sort_weight":101,"slug":102},15,"Posters",60,"posters",{"id":104,"doc_module":22,"doc_module_name":25,"category_name":105,"show_sort_weight":106,"slug":107},16,"Social Media",50,"social-media",{"id":109,"doc_module":22,"doc_module_name":25,"category_name":110,"show_sort_weight":111,"slug":112},17,"Forms",40,"forms",{"id":114,"doc_module":22,"doc_module_name":25,"category_name":115,"show_sort_weight":116,"slug":117},18,"Letters",30,"letters",{"id":119,"doc_module":22,"doc_module_name":25,"category_name":120,"show_sort_weight":55,"slug":121},21,"Paper Templates","papers-templates",{"id":123,"doc_module":22,"doc_module_name":25,"category_name":124,"show_sort_weight":4,"slug":125},158,"General","general-158",{"code":4,"msg":82,"data":127},{"doc_id":79,"user_id":128,"nickname":42,"user_avatar":129,"doc_module":22,"category_id":85,"category_name":29,"doc_title":10,"doc_description":12,"doc_content":130,"file_id":131,"file_url":132,"file_type":133,"file_size":134,"view_count":55,"is_deleted":4,"is_public":22,"is_downloadable":22,"audit_status":22,"page_count":135,"language":136,"language_code":8,"site_id":7,"html_lang":8,"table_of_contents":137,"faqs":138,"seo_title":139,"seo_description":12,"update_tm":140,"read_time":33},1099529839121,"https://ap-avatar.wpscdn.com/davatar_994ba38a5ba835b3df7d355c54d3ed8d","Preventing Server-Side Request Forgery Attacks  \nBahruz Jabiyev  \nNortheastern University [bahruz@ccs.neu.edu](bahruz@ccs.neu.edu)  \nOmid Mirzaei  \nNortheastern University [o.mirzaei@northeastern.edu](o.mirzaei@northeastern.edu)  \nAmin Kharraz  \nFlorida International University [ak@cs.fiu.edu](ak@cs.fiu.edu)  \nEngin Kirda  \nNortheastern University [ek@ccs.neu.edu](ek@ccs.neu.edu)  \nABSTRACT  \nIn today’s web, it is not uncommon for web applications to take a complete URL as input from users. Usually, once the web application receives a URL, the server opens a connection to it. However, if the URL points to an internal service and the server still makes the connection, the server becomes vulnerable to Server-Side Request Forgery (SSRF) attacks. These attacks can be highly destructive when they exploit internal services. They are equally destructive and need much less effort to succeed if the server is hosted in a cloud environment. Therefore, with the growing use of cloud computing, the threat of SSRF attacks is becoming more serious.  \nIn this paper, we present a novel defense approach to protect internal services from SSRF attacks. Our analysis of more than 60 SSRF vulnerability reports shows that developers’ awareness about this vulnerability is generally limited. Therefore, coders usually have flaws in their defenses. Even when these defenses have no flaws, they are usually still affected by important security and functionality limitations. In this work, we develop a prototype based on the proposed approach by extending the functionality of a popular reverse proxy application and deploy a set of vulnerable web applications with that prototype. We demonstrate how SSRF attacks on these applications, with almost no loss of performance, are prevented.  \nACM Reference Format:  \nBahruz Jabiyev, Omid Mirzaei, Amin Kharraz, and Engin Kirda. 2021. Preventing Server-Side Request Forgery Attacks. In The 36th ACM/SIGAPP Symposium on Applied Computing (SAC’21), March 22–26, 2021, Virtual Event, Republic of Korea. ACM, New York, NY, USA, 10 pages. [https://doi](https://doi). org/10.1145/3412841.3442036  \n1 INTRODUCTION  \nWeb applications have been always an attractive attack vector for adversaries. These applications are often open to the public-facing Internet and are commonly used to handle critical tasks and valuable data. Despite much attention to web applications in the security community, there has been little investigation into attacks on the trust relationship between web applications and critical services  \nPermission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for components of this work owned by others than ACM must be honored. Abstracting with credit is permitted. To copy otherwise, or republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. Request permissions [from permissions@acm.org](from permissions@acm.org).  \nSAC’21, March 22–26, 2021, Virtual Event, Republic of Korea © 2021 Association for Computing Machinery.  \nACM ISBN 978-1-4503-8104-8/21/03. . . $15.00 [https://doi.org/10.1145/3412841.3442036](https://doi.org/10.1145/3412841.3442036)  \ninside a target network. These attacks are often severe [35] and can render almost all of the contemporary security mechanisms ineffective.  \nIn this work, we primarily focus on Server-Side Request Forgery (SSRF) attacks where the vulnerable web application redirects the attacker’s requests to the internal network and exposes local services to the remote attacker, introducing different forms of risks [17] . The goal of this work is to reduce the risk of such crippling attacks by proposing a systematic framework that handles untrusted incoming requests without imposing a discernible performance impact ","cbCaitCSurh4Rsyq","https://ap.wps.com/l/cbCaitCSurh4Rsyq","pdf",1132571,10,"English","# Abstract\n# 1 Introduction\n## Web applications as attack vectors\n## Focus on SSRF and risk reduction\n## SSRF attack variants in internal services\n## Difficulty of mitigating SSRF vulnerabilities\n## Attack landscape and HackerOne report analysis","[{\"question\":\"Why are SSRF attacks dangerous for internal services?\",\"answer\":\"If a web application opens a connection to a user-supplied URL that targets an internal service, the server can expose local services to a remote attacker, making the trust relationship exploitable.\"},{\"question\":\"What does the paper propose to defend against SSRF?\",\"answer\":\"It presents a novel defense approach that protects internal services from SSRF by developing a prototype that extends a popular reverse proxy and deploying vulnerable web applications using it.\"},{\"question\":\"How do the authors evaluate the effectiveness of the defense?\",\"answer\":\"The paper demonstrates that SSRF attacks on the deployed applications can be prevented with almost no loss of performance.\"}]","Preventing Server-Side Request Forgery Attacks - A Novel Defense Approach | PDF",1791922865]