Fix SSRF (Server Side Request Forgery) in Nuxt

SSRF in Nuxt/Nitro is a high-impact vulnerability where the server-side engine fetches arbitrary URLs provided by the client. Because Nuxt often runs in environments with access to internal metadata services (like AWS/GCP instance metadata) or private microservices, an unvalidated proxy endpoint allows attackers to leak sensitive credentials or map internal networks. If you're using $fetch or useFetch on the server with user-controlled input, you're likely exposed.

The Vulnerable Pattern

// server/api/fetch-external.ts
export default defineEventHandler(async (event) => {
  const { targetUrl } = getQuery(event);
  // VULNERABLE: Direct injection of user input into a server-side request
  const response = await $fetch(targetUrl as string);
  return response;
});

The Secure Implementation

The fix employs a multi-layered defense. First, we use the 'ufo' utility (bundled with Nuxt) to safely parse the URL. We enforce a strict allowlist of domains to ensure the server only communicates with trusted partners. We also explicitly check the protocol to prevent 'file://', 'gopher://', or 'http://' smuggling. For production-grade security, consider resolving the hostname to an IP address and verifying it does not fall within RFC1918 private ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) or the loopback address to mitigate DNS rebinding attacks.

// server/api/fetch-external.ts
import { parseURL } from 'ufo';
const ALLOWED_DOMAINS = [‘api.trusted-partner.com’, ‘cdn.myapp.com’];
export default defineEventHandler(async (event) => {
const { targetUrl } = getQuery(event);
if (typeof targetUrl !== ‘string’) throw createError({ statusCode: 400 });
const parsed = parseURL(targetUrl);
// 1. Enforce Protocol
if (parsed.protocol && parsed.protocol !== ‘https:’) {
throw createError({ statusCode: 403, statusMessage: ‘Insecure protocol’ });
}
// 2. Strict Domain Allowlist
if (!parsed.host || !ALLOWED_DOMAINS.includes(parsed.host)) {
throw createError({ statusCode: 403, statusMessage: ‘Disallowed target host’ });
}
// 3. Prevent SSRF via $fetch
return await $fetch(targetUrl);
});