---
title: "Fetch only allowed addresses · Agent Wranglers"
url: https://agentwranglers.se/playbook/adversarial-testing/requests-and-files/block-server-side-request-forgery
updated: 2026-10-20
licence: "All rights reserved"
---

# Fetch only allowed addresses

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Required
- Chapter: [Requests and files](https://agentwranglers.se/playbook/adversarial-testing/requests-and-files)
- Rule: When the server fetches an address a user gave, allow only the hosts it needs. Never reach internal or cloud metadata addresses.
- How: Keep an allow-list of hosts. Resolve the name, and refuse private, loopback and link-local addresses, in IPv4 and IPv6. Connect to the address you checked, so a second DNS answer can't swap it. Check every redirect again, or turn redirects off. Use a library or an egress proxy rather than your own IP parser. On AWS, require IMDSv2.
- Check: The agent gives the fetch feature internal addresses, including one behind a redirect. Every one is refused.

Example:

```text
http://127.0.0.1:8080/
http://169.254.169.254/latest/meta-data/
http://[::1]/
http://0x7f000001/
http://0.0.0.0:8080/
http://metadata.google.internal/computeMetadata/v1/
http://[fd00:ec2::254]/latest/meta-data/
https://redirect.example.net/to?url=http://10.0.0.5/
```

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers security testing playbook: https://agentwranglers.se/playbook/adversarial-testing/requests-and-files/block-server-side-request-forgery`.

- Next: [Check every uploaded file](https://agentwranglers.se/playbook/adversarial-testing/requests-and-files/safe-file-uploads)
- [Requests and files](https://agentwranglers.se/playbook/adversarial-testing/requests-and-files)