--- title: "Fetch only allowed addresses ยท Agent Wranglers" url: https://agentwranglers.se/playbook/application-security/requests-files-and-caches/block-server-side-request-forgery id: APS-41 level: Required risk: takeover updated: 2026-10-27 build: a2a6bdfed830 tokens: 1250 licence: "CC BY 4.0" licence_url: https://creativecommons.org/licenses/by/4.0/ --- # Fetch only allowed addresses For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Requests, files and caches](https://agentwranglers.se/playbook/application-security/requests-files-and-caches.md). By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-27. - ID: APS-41 - Level: Required - Chapter: [Requests, files and caches](https://agentwranglers.se/playbook/application-security/requests-files-and-caches.md) - Rule: When the server fetches an address a user gave, allow only the hosts it needs. Never reach internal or cloud metadata addresses. - Check: On the test copy, the agent gives the fetch feature `http://127.0.0.1`, `http://2130706433`, `http://[::ffff:127.0.0.1]` and `http://169.254.169.254`. It adds a name that resolves to `10.0.0.5` and an address that redirects inside. Then it tries a name whose DNS answer changes from public to internal between two lookups. Every fetch is refused, and the internal test server logs no request. - Risk: An account or system taken over - How: Keep an allow-list of hosts and allow only `https`, or `http` where needed. Parse the address with one standard parser, then resolve the name. Refuse private, loopback, link-local, unspecified and multicast addresses in IPv4 and IPv6. That includes `0.0.0.0`, `::1`, `fc00::/7`, `fe80::/10` and IPv4 inside IPv6, such as `::ffff:127.0.0.1`. Compare the resolved address, never the text, since `2130706433` and `0x7f.1` both mean `127.0.0.1`. Connect to the address you checked, so a second DNS answer cannot swap it, which is called DNS rebinding. Turn redirects off, or check each hop again with the same code. Cap the answer size and the time, such as 1 MB and 5 seconds. Push endpoints sent by browsers need the same care, as [Accept push endpoints only from known push services](https://agentwranglers.se/playbook/notifications/web-push/push-endpoint-allow-list.md) says. Use a library or an egress proxy rather than your own IP parser. Block the cloud metadata addresses, `169.254.169.254` and `fd00:ec2::254`, at the network too. On AWS, require IMDSv2 with a hop limit of 1, so a container cannot reach it. ## Examples **Using these examples:** they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses. ### Plain text example ```text http://127.0.0.1:8080/ http://169.254.169.254/latest/meta-data/ http://[::1]/ http://0x7f000001/ http://0.0.0.0:8080/ http://metadata.google.internal/computeMetadata/v1/ http://[fd00:ec2::254]/latest/meta-data/ https://redirect.example.net/to?url=http://10.0.0.5/ ``` ## Sources - [OWASP Server-Side Request Forgery Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html) ## Related rules - INF-32 [Limit where servers can send traffic](https://agentwranglers.se/playbook/infrastructure/networking-and-dns/egress-control.md) in Infrastructure and environments - INF-34 [Require tokens for the metadata service](https://agentwranglers.se/playbook/infrastructure/networking-and-dns/metadata-service-tokens.md) in Infrastructure and environments - NTF-19 [Accept push endpoints only from known push services](https://agentwranglers.se/playbook/notifications/web-push/push-endpoint-allow-list.md) in Notifications - AGT-2 [Fetch key directories with network limits](https://agentwranglers.se/playbook/agents-as-users/identifying-agents/safe-key-directory-fetch.md) in Agents as users - TNS-19 [Check links in user content against phishing and malware lists](https://agentwranglers.se/playbook/trust-and-safety/sign-up-fraud-and-abuse/link-scanning.md) in Trust and safety - MED-14 [Run media tools in a sandbox with no network](https://agentwranglers.se/playbook/files-and-media/video-and-audio/media-tool-sandbox.md) in Files and media - MED-22 [Render documents with no network and no local files](https://agentwranglers.se/playbook/files-and-media/generated-documents/sandboxed-rendering.md) in Files and media - EVT-26 [Check webhook addresses before sending](https://agentwranglers.se/playbook/events/webhooks/webhook-targets.md) in Integration and events **For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `Agent Wranglers application security playbook`. In code you write, add a comment next to it with the same link. - Next: [Treat data from other APIs as untrusted](https://agentwranglers.se/playbook/application-security/requests-files-and-caches/third-party-api-data.md) - [Requests, files and caches](https://agentwranglers.se/playbook/application-security/requests-files-and-caches.md)