Webhooks are a common product feature: the user supplies a URL, and your server makes a request to it when an event occurs. That design hands an attacker partial control over your server’s outbound requests, which is the essence of server-side request forgery (SSRF).
The impact
An attacker who can steer outbound requests may reach internal services, cloud metadata endpoints, or other resources that are only reachable from inside your network perimeter. The response, or even the timing of it, can leak sensitive information or trigger unintended actions.
Constraining outbound requests
- Resolve the destination hostname and validate the resulting IP against a denylist of internal ranges, then connect to that resolved address to avoid DNS rebinding.
- Disallow redirects to addresses that would fail the same validation.
- Send webhook traffic through an egress proxy with an explicit allowlist.
- Strip credentials and metadata headers from outbound webhook requests.
Clearly-marked sample content for development and testing; it describes a general vulnerability class rather than a specific product.