Is Your Node.js App Vulnerable to SSRF? Secure Axios & Fetch in 5 Minutes

#node #security #typescript #javascript

If your Node.js application accepts user-supplied URLs—whether you are building a webhook system, a link preview feature, or a file uploader—you might be wide open to Server-Side Request Forgery (SSRF).

Most developers think a quick regex check to block localhost or 127.0.0.1 makes them safe.

It doesn't.

An attacker can easily bypass standard string-matching filters using advanced exploitation techniques:

DNS Rebinding: Setting up a custom domain that resolves to a safe public IP on the first lookup (passing your validation) but resolves to a local IP on the second lookup (when your app actually executes the fetch).
Cloud Metadata Exploitation: Accessing internal cloud provider endpoints like AWS IMDSv2 (169.254.169.254) to steal IAM roles, API tokens, and infrastructure credentials.
Internal Subnet Scanning: Forcing your server to act as a proxy to probe private company microservices (10.0.0.0/8 or 192.168.0.0/16).

To solve this problem comprehensively at the network runtime layer, I built ssrf-agent-guard—a lightweight, defensive TypeScript module that hardens http.Agent and https.Agent against runtime exploits.

🔒 Deep Protection via Custom Network Agents

Instead of trying to sanitize unsafe string inputs, ssrf-agent-guard intercepts requests during the actual network cycle. It executes pre-and-post DNS resolution host checks, ensuring your application never communicates with a forbidden destination.

Here is how easily it drops right into Axios:

const ssrfAgentGuard = require('ssrf-agent-guard');

const unsafeUserUrl = 'http://169.254.169';

axios.get(unsafeUserUrl, {
  // Automatically intercept and abort before connections are established
  httpAgent: ssrfAgentGuard(unsafeUserUrl),
  httpsAgent: ssrfAgentGuard(unsafeUserUrl)
})
.then((response) => console.log('Success'))
.catch((error) => console.error('Blocked Securely:', error.message));

It works exactly the same way with native fetch or node-fetch:

fetch(unsafeUserUrl, { agent: ssrfAgentGuard(unsafeUserUrl) });

🛡️ Core Security Capabilities

This package abstracts away complex networking logic into clean, production-grade defenses:

1. Cloud Provider Metadata Detection

It blocks explicit access to cloud environment endpoints across all major infrastructure systems, covering AWS, Google Cloud Platform (GCP), Microsoft Azure, Oracle Cloud, DigitalOcean, and Kubernetes clusters.

2. Built-in DNS Rebinding Mitigation

The agent evaluates the resolved IP addresses right before a socket connection opens. If a malicious domain attempts to switch its resolution from a public address to a restricted internal IP post-validation, the module catches the shift and terminates the request immediately.

3. Policy-Based Domain Filtering

You can configure explicit access rules using strict allowlists, denylists, and top-level domain (TLD) blocking architectures:

const agent = ssrfAgentGuard('https://example.com', {
  mode: 'block',              // Options: 'block' | 'report' | 'allow'
  detectDnsRebinding: true,   // Kill time-of-check to time-of-use exploits
  policy: {
    allowDomains: ['*.trustedpartners.com'], 
    denyDomains: ['untrusted-source.evil'], 
    denyTLD: ['local', 'internal', 'lan'] 
  }
});

📊 Flexible Operation Modes

Securing a legacy system can be intimidating. ssrf-agent-guard includes multiple operation modes so you can safely gauge its impact before turning on enforcement:

block: The default defensive state. Dropping malicious requests instantly.
report: A passive observational mode. It logs violations via a custom handler so you can trace vulnerabilities in your production traffic without breaking current user loops.
allow: Bypasses restrictions entirely for specialized debugging environments.

🛠️ Fully Typed and Production-Tested

The engine is authored completely in TypeScript, bringing full autocompletion support to your IDE. It ships with ready-made architecture guides and implementation examples for major modern web frameworks: