Server-Side Request Forgery (SSRF) is one of the most critical OWASP vulnerabilities in modern PHP apps. Discover how to prevent SSRF and DNS rebinding attacks with a single line of code using the new UrlValidator in Nette Http 3.4.0. Protect your cloud infrastructure today.

Nette's platform is a central hub for PHP developers, offering insights into web application development, PHP frameworks, and modern PHP practices. Through articles, tutorials, and community forums, Nette offers insights into building secure and maintainable web applications with Nette Framework. Developers can learn about dependency injection, template engines, and database abstraction layers to create elegant and efficient PHP applications.

Nette

Nette/Http 3.4.0 introduces UrlValidator and IPAddress classes to protect PHP applications against Server-Side Request Forgery (SSRF) attacks. UrlValidator resolves hostnames to IPs and blocks loopback, private ranges, link-local (including cloud metadata endpoints like 169.254.169.254), multicast, and IANA-reserved addresses. It also provides getResolvedIPs() to pass validated IPs directly to cURL via CURLOPT_RESOLVE, closing the DNS rebinding window. The IPAddress class handles IPv4/IPv6 including IPv4-mapped IPv6 forms that naive checks miss. Version 3.4 also adds Sec-Fetch-* header-based CSRF protection, partitioned cookie support (CHIPS), a SameSite enum, unified cookie expiration handling, and requires PHP 8.3+.

How to Prevent SSRF Attacks in PHP: Nette Http 3.4.0 – Nette Blog

How SSRF Attacks Work in Cloud Environments

Validating IPv4 and IPv6 Addresses in PHP