Fix SSRF (Server Side Request Forgery) in Lumen
Server-Side Request Forgery (SSRF) in Lumen occurs when the application fetches a remote resource based on user-supplied input without proper validation. In a microservices architecture, this is high-risk as it allows attackers to bypass firewalls and hit internal APIs, metadata services (like AWS IMDS at 169.254.169.254), or databases that trust the application server's IP.
The Vulnerable Pattern
public function fetchResource(Request $request) {
// DANGER: Raw user input passed directly to Guzzle
$url = $request->input('url');
$client = new \GuzzleHttp\Client();
$response = $client->get($url);
return $response->getBody()->getContents();
}The Secure Implementation
The secure implementation enforces three critical layers of defense. First, it restricts schemes to HTTP/S to prevent protocol smuggling (e.g., file:// or gopher://). Second, it resolves the hostname to an IP and uses PHP's FILTER_FLAG_NO_PRIV_RANGE and FILTER_FLAG_NO_RES_RANGE to block requests to local (127.0.0.1) and private (10.x.x.x, 192.168.x.x) networks. Third, it disables Guzzle's 'allow_redirects' to prevent an attacker from redirecting a 'safe' URL to an internal one after the initial check is passed.
public function fetchResource(Request $request) { $url = $request->input('url'); $components = parse_url($url);// 1. Protocol Whitelisting if (!in_array($components['scheme'], ['http', 'https'])) { return response('Invalid protocol', 400); } // 2. DNS Resolution and IP Validation $ip = gethostbyname($components['host']); if (!filter_var($ip, FILTER_VALIDATE_IP, FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE)) { return response('Internal or Reserved IP detected', 403); } // 3. Prevent Redirect Bypasses (TOCTOU) $client = new \GuzzleHttp\Client([ 'allow_redirects' => false, 'connect_timeout' => 2.0, 'timeout' => 5.0 ]); try { $response = $client->get($url); return $response->getBody()->getContents(); } catch (\Exception $e) { return response('Request failed', 500); }
}
Your Lumen API
might be exposed to SSRF (Server Side Request Forgery)
74% of Lumen apps fail this check. Hackers use automated scanners to find this specific flaw. Check your codebase before they do.
Free Tier • No Credit Card • Instant Report
Verified by Ghost Labs Security Team
This content is continuously validated by our automated security engine and reviewed by our research team. Ghost Labs analyzes over 500+ vulnerability patterns across 40+ frameworks to provide up-to-date remediation strategies.