Post #2703531

Layered defenses matter... you can add all the host defenses possible and you will still have "credential" leak risk (credential here is the bearer token on your api call). Microsoft has open sourced an antiSSRF library which solves for some complicated cases that are easily overlooked, like TOCTUA defenses against DNS rebinding and other subtle risks. https://github.com/microsoft/antissrf