Fix SSRF (Server Side Request Forgery) in Express
SSRF occurs when an Express application fetches a remote resource without validating the user-supplied URL. In a cloud environment, this is a p0 vulnerability, allowing attackers to hit the internal metadata service (169.254.169.254) or scan internal microservices. If your app acts as a proxy, you must assume all input is malicious and enforce strict outbound controls.
The Vulnerable Pattern
const express = require('express'); const axios = require('axios'); const app = express();
app.get(‘/fetch-profile’, async (req, res) => { const { url } = req.query; // CRITICAL VULNERABILITY: User-controlled URL is passed directly to axios try { const response = await axios.get(url); res.send(response.data); } catch (err) { res.status(500).send(‘Internal Server Error’); } });
The Secure Implementation
The secure implementation utilizes three layers of defense. First, it uses the 'URL' constructor to properly parse the input, preventing bypasses using encoded characters or malformed strings. Second, it enforces a strict protocol (HTTPS) and an allowlist of trusted domains, which stops attackers from hitting local file systems or the cloud metadata service. Third, it disables redirects; this is critical because an attacker might provide a 'safe' URL that redirects to an internal IP. For production, always use an SSRF-resistant agent to validate the resolved IP address is not within a private range (RFC 1918).
const express = require('express'); const axios = require('axios'); const { URL } = require('url'); const app = express();const ALLOWED_HOSTS = [‘trusted-api.com’, ‘cdn.example.com’];
app.get(‘/fetch-profile’, async (req, res) => { const { url } = req.query;
try { const parsedUrl = new URL(url);
// 1. Enforce HTTPS only if (parsedUrl.protocol !== 'https:') { return res.status(400).send('Invalid protocol'); } // 2. Strict Hostname Allowlisting if (!ALLOWED_HOSTS.includes(parsedUrl.hostname)) { return res.status(403).send('Target host not allowed'); } // 3. Prevent DNS Rebinding / Private IP access // Use a library like 'ssrf-agent' or 'ipaddr.js' to ensure // hostname doesn't resolve to 127.0.0.1 or 169.254.x.x const response = await axios.get(parsedUrl.href, { timeout: 2000, maxRedirects: 0 // Prevent redirect-based SSRF }); res.send(response.data);
} catch (err) { res.status(400).send(‘Invalid Request’); } });
Your Express API
might be exposed to SSRF (Server Side Request Forgery)
74% of Express apps fail this check. Hackers use automated scanners to find this specific flaw. Check your codebase before they do.
Free Tier • No Credit Card • Instant Report
Verified by Ghost Labs Security Team
This content is continuously validated by our automated security engine and reviewed by our research team. Ghost Labs analyzes over 500+ vulnerability patterns across 40+ frameworks to provide up-to-date remediation strategies.