Node.js · Senior · Question 29 of 75
Your API fetches a URL supplied by the user (e.g. for link previews). What attack must you prevent?
- 1Clickjacking
- ✓Correct answer: SSRF: the server can be made to call internal services or cloud metadata endpoints like
169.254.169.254 - 3CSRF in the user's browser
Explanation
Allow only needed schemes and ports, resolve the host and block private and link-local ranges, disable or re-check redirects, and use network-level egress rules.