API Testing · Senior · Question 16 of 75

How do you test for SSRF in an API that fetches a URL you provide?

1Give internal addresses like 169.254.169.254 and check they're blocked
2Give a very long URL and check it's cut to a shorter length
3Give a URL with capital letters and check it still works

Show the answer

Correct answer: Give internal addresses like 169.254.169.254 and check they're blocked

Explanation

Server-side request forgery lets attackers reach internal services or cloud metadata. Allow-lists and blocking private ranges are the fix.

Further reading

OWASP API Security Top 10 (2023) ↗

Test yourself

Take the API Testing · Senior quiz: questions and options are shuffled, and you get a review of your mistakes at the end.