Internal request routing is when an application forwards a request to backend services that are meant to stay private, such as admin APIs, metadata endpoints, or service-to-service interfaces. The frontend user may only see a normal feature, but the application acts as a proxy or orchestrator behind the scenes.
This matters because routing mistakes can expose secrets or privileged actions without directly exposing the target service. Attackers may abuse weak validation, parameter injection, or SSRF-style paths to steer traffic toward internal-only endpoints and retrieve tokens, configuration data, or other sensitive responses. Defenders reduce the risk by enforcing strict allowlists, separating public and private network paths, authenticating every backend call, and logging unusual internal destination targets.