Web Security · Senior · Question 58 of 75

Your server fetches a URL that users provide for link previews. What's the biggest risk?

1The preview image might be too large
2Users might share links to competitors
✓Correct answer: SSRF: the request can target internal services or the cloud metadata endpoint like 169.254.169.254

Explanation

Resolve the host, block private and link-local ranges after DNS resolution and on redirects, or route fetches through an isolated egress proxy.

Further reading

Test yourself

Take the Web Security · Senior quiz: questions and options are shuffled, and you get a review of your mistakes at the end.