Skip to content

Server-Side Request Forgery

Diagnose the web attack in which an attacker-supplied URL makes a server issue a request under its own credentials and network position, by asking whether the issuer of the intent and the carrier of the authority are the same principal.

Core Idea

Server-side request forgery (SSRF) is the vulnerability in which an attacker causes a server to issue network requests on the attacker's behalf — carrying the server's own credentials and network position — by supplying a URL the server fetches during normal operation. Its defining move dissociates who issued the instruction (the attacker, via input) from whose authority executes it (the server). It is the HTTP instantiation of the confused-deputy problem, and the fix is not authentication hardening but reattaching intent-provenance to authority.

Scope of Application

Lives wherever a server makes input-derived outbound connections under its own network identity.

  • Outbound-fetch features — link-preview generators, webhook receivers, RSS pullers, image-URL resolvers, asset renderers.
  • Cloud metadata endpoints — 169.254.169.254 vending IAM credentials, turning a fetch into credential theft.
  • Perimeter-trusted internal services — admin APIs, Redis, LDAP reachable from inside but never authenticated to.
  • Localhost and loopback ports — services bound to the server's own machine, exposed when the target is steered to localhost.
  • Web-security confused-deputy siblings — CSRF, cross-site script inclusion, cryptographic signing oracles.

Clarity

Naming SSRF makes visible a bifurcation the server's own logs conceal: without it a defender sees a request the server was authorized to make and asks only whether it was reasonable — always yes. The label splits the act into the issuer of the instruction and the carrier of the authority, so the sharp question becomes "did authority and intent point at the same principal?" That reframing also tells the defender they are hardening the wrong thing: since authentication was never broken, the fix is intent-provenance, not identity.

Manages Complexity

Audited as a grid of fetch-feature by internal-target, the defender faces a combinatorial sprawl where every cell answers innocuous because the server authenticated correctly. SSRF collapses that grid to one confused-deputy relation: every cell is the server's authority directed at a target by an instruction it did not originate. The defender tracks only the alignment of two principals per action, and sorts every defense by which leg of the bifurcation it repairs — intent or reach.

Abstract Reasoning

SSRF licenses a diagnostic move evaluating a request by whether issuer and carrier align rather than whether it was allowed, a triadic O-I-T structure move predicting where the vulnerability lives and what it yields, a boundary-drawing move separating forgery from impersonation and delegation to redirect effort from authentication to intent-provenance, a two-leg interventionist move routing each fix onto the intent or reach leg, and a system-audit move replacing the per-cell grid with one alignment test.

Knowledge Transfer

Within web-application security SSRF transfers as mechanism across every server-fetch feature and internal target, because each is the same substrate — a server making input-derived outbound connections under its own identity — and the sibling web attacks (CSRF, signing oracles) are confused-deputy variants in that substrate. Beyond it the transfer is shared abstract mechanism: the confused-deputy pattern recurs as genuine co-instances (payment-instruction fraud, agency law, diplomatic seals, chancery clerks), and even the interventions generalize. That portable content travels as the parent confused_deputy prime; the URL fetch, metadata endpoint, IAM roles, and RFC-1918 blocking stay home.

Relationships to Other Abstractions

Local relationship map for Server-Side Request ForgeryParents appear above the current abstraction, mutual partners to the right, and children below. Node labels state whether each abstraction is prime or domain-specific; colors identify relation types.Server-SideRequest ForgeryDOMAINPrime abstraction: Confused Deputy — is a decomposition ofConfused DeputyPRIME

Current abstraction Server-Side Request Forgery Domain-specific

Parents (1) — more general patterns this builds on

  • Server-Side Request Forgery is a decomposition of Confused Deputy Prime

    SSRF is the web-request form of a confused deputy: an outsider supplies intent while a trusted server supplies network position and credentials.

Hierarchy paths (4) — routes to 4 parentless roots

Neighborhood in Abstraction Space

Server-Side Request Forgery sits in a sparse region of the domain-specific corpus (69th percentile for distinctiveness): few abstractions share its structure, so a faithful description tends to retrieve it precisely.

Family — Unclustered & Miscellaneous (309 abstractions)

Nearest neighbors

Computed from structural-signature embeddings · 2026-07-12