Destination validation is a security check that verifies a request is allowed to reach only approved hosts, IP ranges, domains, or services. It is used when an application fetches a URL, follows redirects, opens a webhook, or otherwise makes a server-side network request. The goal is to prevent untrusted input from steering the server toward internal systems, localhost services, or cloud metadata endpoints.
This matters because weak destination checks can turn a normal feature into a server-side request forgery (SSRF) path. Attackers may supply a crafted URL, an encoded IP address, or a redirect chain to make the server probe hidden infrastructure or leak credentials. Defenders use allowlists, DNS and IP revalidation, redirect restrictions, proxy controls, and egress filtering to enforce destination validation. In practice, strong validation is a key boundary control for any service that can make outbound requests on a user’s behalf.