Fix SSRF (Server Side Request Forgery) in Polka
SSRF (Server-Side Request Forgery) in Polka environments occurs when the application accepts a user-controlled URL to perform backend requests. Without validation, an attacker can coerce the server into scanning internal ports, hitting cloud metadata services like 169.254.169.254, or bypassing firewalls to access internal-only microservices.
The Vulnerable Pattern
const polka = require('polka'); const fetch = require('node-fetch');
polka() .get(‘/proxy’, async (req, res) => { const { target } = req.query; // DANGER: No validation on ‘target’. // Attacker can pass ‘http://localhost:6379’ or ‘http://169.254.169.254/latest/meta-data/’ const response = await fetch(target); const data = await response.text(); res.end(data); }) .listen(3000);
The Secure Implementation
The fix involves three layers of defense. First, use the native 'URL' constructor to parse input; this prevents bypasses using malformed strings. Second, enforce the 'https' protocol to stop attackers from using 'file://' or 'gopher://' schemes. Third, implement a strict hostname allowlist. For production-grade security, you should also resolve the hostname to an IP and verify it does not fall within private or loopback ranges (e.g., 10.0.0.0/8, 127.0.0.0/8) to mitigate DNS Rebinding attacks.
const polka = require('polka'); const fetch = require('node-fetch'); const { URL } = require('url');const ALLOWED_HOSTS = [‘api.trusted-service.com’, ‘images.cdn.com’];
polka() .get(‘/proxy’, async (req, res) => { try { const { target } = req.query; const parsed = new URL(target);
// 1. Protocol Whitelisting if (parsed.protocol !== 'https:') { res.statusCode = 400; return res.end('Only HTTPS is permitted.'); } // 2. Domain Whitelisting if (!ALLOWED_HOSTS.includes(parsed.hostname)) { res.statusCode = 403; return res.end('Disallowed target host.'); } const response = await fetch(parsed.href); const data = await response.text(); res.end(data); } catch (err) { res.statusCode = 400; res.end('Invalid URL or Request'); }
}) .listen(3000);
Your Polka API
might be exposed to SSRF (Server Side Request Forgery)
74% of Polka apps fail this check. Hackers use automated scanners to find this specific flaw. Check your codebase before they do.
Free Tier • No Credit Card • Instant Report
Verified by Ghost Labs Security Team
This content is continuously validated by our automated security engine and reviewed by our research team. Ghost Labs analyzes over 500+ vulnerability patterns across 40+ frameworks to provide up-to-date remediation strategies.