vulns.co
/
GKData.io MCP

OWASP Cheat Sheet Series · 1 min read

OWASP Server-Side Request Forgery Prevention

Explains destination validation and network isolation for server-initiated requests, distinguishing fixed trusted destinations from services that need broader external access.

Open the reference Implementation GuideReviewed 2026-10-02

How to use this reference

Review owned-service destination policy, parser consistency, redirect behavior and independent egress restrictions.

Before reading

  • Basic knowledge of web requests and application/network boundaries

Context and limits

  • The destination-policy design depends on business requirements. Metadata protections complement application validation and network isolation.

Related visual models

A requested destination passes consistent parsing, application policy and independent network egress checks. Invalid input or either policy failure is rejected. Only an approved destination is requested.

Conceptual model Diagram

Layer server-request destination controls

Original conceptual defense-in-depth model linked to the historical Shopify Exchange case and OWASP guidance. It is not a vendor architecture diagram. Policy must fit the service’s destination requirements.

Reviewed 2026-10-02Read

Sources and provenance

  1. Server-Side Request Forgery Prevention Cheat Sheet OWASP · reviewed 2026-10-02

Record reviewed 2026-10-02. Snapshot d5550c789111. Open the complete JSON contract.

GitHub snapshot 2026-10-04

d5550c789111 · JSON exports & schemas · CC BY 4.0 content / MIT software