Fix SSRF (Server Side Request Forgery) in Gorilla
SSRF in Gorilla-based applications occurs when the backend blindly trusts user-supplied URLs to fetch resources. This allows attackers to scan internal networks, hit metadata services (IMDS), or bypass firewalls. To kill SSRF, you must enforce a strict allowlist, validate protocols, and prevent access to non-routable IP ranges.
The Vulnerable Pattern
func VulnerableHandler(w http.ResponseWriter, r *http.Request) {
target := r.URL.Query().Get("url")
resp, err := http.Get(target) // CRITICAL: No validation of user input
if err != nil {
http.Error(w, "Fetch failed", 500)
return
}
defer resp.Body.Close()
io.Copy(w, resp.Body)
}The Secure Implementation
The secure implementation applies three layers of defense. First, it enforces the HTTPS scheme to prevent protocol smuggling (e.g., file:// or gopher://). Second, it implements a strict host allowlist to ensure the server only communicates with pre-approved external entities. Third, it disables automatic redirects; this is vital because an attacker might provide a 'safe' URL that redirects to an internal IP (like 127.0.0.1 or 169.254.169.254). For production-grade hardening, use a custom net.Dialer to validate that the resolved IP address does not fall within private or loopback ranges.
func SecureHandler(w http.ResponseWriter, r *http.Request) { inputURL := r.URL.Query().Get("url") u, err := url.Parse(inputURL) if err != nil || u.Scheme != "https" { http.Error(w, "Invalid protocol", 400) return }allowedHosts := map[string]bool{"trusted-api.com": true} if !allowedHosts[u.Hostname()] { http.Error(w, "Host not allowed", 403) return } client := &http.Client{ CheckRedirect: func(req *http.Request, via []*http.Request) error { return http.ErrUseLastResponse // Prevent redirect-based SSRF bypasses }, Timeout: 5 * time.Second, } resp, err := client.Get(u.String()) if err != nil { http.Error(w, "Request failed", 500) return } defer resp.Body.Close() io.Copy(w, resp.Body)
}
Your Gorilla API
might be exposed to SSRF (Server Side Request Forgery)
74% of Gorilla apps fail this check. Hackers use automated scanners to find this specific flaw. Check your codebase before they do.
Free Tier • No Credit Card • Instant Report
Verified by Ghost Labs Security Team
This content is continuously validated by our automated security engine and reviewed by our research team. Ghost Labs analyzes over 500+ vulnerability patterns across 40+ frameworks to provide up-to-date remediation strategies.