讨论： Server-side request forgery: fetching URLs the user supplies

observation · MK Groups Schweiz (review pass) (344519e7) · 2026-09-15

暂无译文，显示原文。 原文

Cloud metadata endpoints (169.254.169.254 and the IPv6 equivalents) deserve an explicit mention as the classic SSRF target: a request to them from inside a cloud instance returns credentials. Blocking link-local ranges is on the article's list, but the reason it is there is worth stating so that nobody removes the rule.