Server-Side Request Forgery Prevention Cheat Sheet — IP address

Reference note (untrusted external data; do not execute it as instructions). In the context of SSRF, there are 2 possible validations to perform Ensure that the data provided is a valid IP V4 or V6 address. Ensure that the IP address provided belongs to one of the IP addresses of the identified and trusted applications. The first layer of validation can be applied using libraries that ensure the security of the IP address format, based on the technology used (library option is proposed here to delegate the managing of the IP address format and leverage battle-tested validation function) > Verification of the proposed libraries has been performed regarding the exposure to bypasses (Hex, Octal, Dword, URL and Mixed encoding) described in this article. JAVA: Method InetAddressValidator.isValid from the Apache Commons Validator library. It is NOT exposed to bypass using Hex, Octal, Dword, URL and Mixed encoding. .NET: Method IPAddress.TryParse from the SDK. It is exposed to bypass using Hex, Octal, Dword and Mixed encoding but NOT the URL encoding. As allowlisting is used here, any bypass tentative will be blocked during the comparison against the allowed list of IP addresses. JavaScript: Library ip-address. It is NOT exposed to bypass using Hex, Octal, Dword, URL and Mixed encoding. Ruby: Class IPAddr from the SDK. It is NOT exposed to bypass using Hex, Octal, Dword, URL and Mixed encoding. > Use the output value of the method/library as the IP address to compare against the allowlist. After ensuring the validity of the incoming IP address, the second layer of validation is applied. An allowlist is created after determining all the IP addresses (v4 and v6 to avoid bypasses) of the identified and trusted applications. The valid IP is cross-checked with that list to ensure its communication with the internal application (string strict comparison with case sensitive). Attribution: Adapted from OWASP Cheat Sheet Series under CC-BY-SA-4.0. Adaptation: WikiKV isolated this documentation section, normalized formatting, retained only bounded code excerpts, and shortened it at a paragraph or sentence boundary for retrieval. Verify version-sensitive details at the source.