The attacker cannot access your private network. Your backend can. That’s the SSRF problem

I said it in 2025 and they hosted a space for me, backend is more than just crud!

I sat down and try to reason why I would trust a user to input anything that I will run like a link or something. For files I simply return back the url let the user go get it himself. I think separating your server from media service is the smartest system makes it faster even.

Equivalent of CSRF on the client side

This is so good. Thanks for the information always boss.

lol, I was reading about SSRF this morning 😂 and this is what I see on my TL right after

XSRF CSRF SSRF All points to one thing "Never trust anything coming from the clients browser" However, your server shouldnt be handling static files though. Allow 3rd party apps handle them and you save the public URLs and ID. Save yourself all this stress.

E b like you no wan respond to my dm 😢

please what ear piece is that? is it for monitoring?

Yes IEM

I think response models really prevents this a lot.

It's crazy how your server can be used to attack your server

Just like social engineering your own application