Server-Side Request Forgery (SSRF) is a vulnerability where an attacker tricks a server into sending requests to locations the attacker could not reach directly. The target may be an internal API, localhost, cloud metadata service, or even an external host chosen by the attacker. Because the request comes from the server itself, network filters and client-side controls can be bypassed.
SSRF matters because it turns trusted backend access into an attack path. In real systems it often appears in URL fetchers, webhook handlers, import features, proxy functions, and rewrite rules that accept user-controlled destinations. Defenders reduce risk with strict allowlists, blocking private IP ranges, validating DNS results after resolution, limiting outbound traffic, and removing unnecessary fetch or proxy features. In Apache-style deployments, permissive proxy or routing configuration can widen the trust boundary and make SSRF easier to trigger.