Fix SSRF (Server Side Request Forgery) in Helidon
SSRF in Helidon occurs when the WebClient or Jakarta REST Client is used to fetch resources based on unvalidated user input. This allows attackers to pivot into your internal network, hit cloud metadata endpoints (169.254.169.254), or scan local services. To kill SSRF, you must implement strict domain allow-listing and block internal IP ranges.
The Vulnerable Pattern
public void proxyRequest(ServerRequest req, ServerResponse res) {
String userUrl = req.query().get("url"); // Blindly trusting user input
WebClient client = WebClient.builder().build();
client.get()
.uri(userUrl)
.request()
.thenAccept(response -> res.send(response.content()));
}The Secure Implementation
The fix involves three layers of defense. First, parse the input as a URI and enforce the 'https' scheme to prevent protocol smuggling (e.g., file:// or gopher://). Second, implement a strict allow-list of domains; never allow arbitrary IPs. Third, ensure the application is deployed in a network environment where the egress traffic is restricted by a proxy or firewall to prevent DNS rebinding attacks and access to the cloud Instance Metadata Service (IMDS).
private static final ListALLOWED_HOSTS = List.of("api.trusted.com", "cdn.trusted.com");
public void proxyRequest(ServerRequest req, ServerResponse res) { String userUrl = req.query().get(“url”); try { URI uri = new URI(userUrl); if (!“https”.equalsIgnoreCase(uri.getScheme())) { res.status(400).send(“Invalid protocol”); return; } if (!ALLOWED_HOSTS.contains(uri.getHost())) { res.status(403).send(“Forbidden target”); return; } WebClient client = WebClient.builder().build(); client.get().uri(uri).request().thenAccept(r -> res.send(r.content())); } catch (Exception e) { res.status(400).send(“Malformed URL”); } }
Your Helidon API
might be exposed to SSRF (Server Side Request Forgery)
74% of Helidon apps fail this check. Hackers use automated scanners to find this specific flaw. Check your codebase before they do.
Free Tier • No Credit Card • Instant Report
Verified by Ghost Labs Security Team
This content is continuously validated by our automated security engine and reviewed by our research team. Ghost Labs analyzes over 500+ vulnerability patterns across 40+ frameworks to provide up-to-date remediation strategies.