Prevent SSRF Vulnerabilities in Symfony Easily

Server-Side Request Forgery (SSRF) is a critical web application vulnerability where an attacker manipulates server-side requests to access internal resources or external systems. If you're using Symfony, this blog will walk you through identifying, exploiting, and preventing SSRF vulnerabilities—complete with real coding examples and free online tools for detection.

     🔍 Want to check your website for SSRF or other security issues? Try our website vulnerability scanner online free.

🛡️ What is SSRF?

SSRF occurs when a web application fetches a remote resource (like a URL) based on user input without proper validation. Attackers exploit this behavior to:

• Access internal systems not exposed to the public

• Enumerate internal services (e.g., AWS metadata, local APIs)

• Perform port scanning within private networks
  
  

⚙️ SSRF in Symfony Framework

Symfony apps often use components like HttpClient, Guzzle, or raw file_get_contents() for making HTTP requests. If user input controls the destination URL, it can lead to SSRF.

🧪 Vulnerable Example (Symfony Controller)

use Symfony\Component\HttpFoundation\Request;

use Symfony\Component\HttpFoundation\Response;

use Symfony\Contracts\HttpClient\HttpClientInterface;

class VulnerableController

{

    private $client;

    public function __construct(HttpClientInterface $client)

    {

        $this->client = $client;

    }

    public function fetchRemote(Request $request): Response

    {

        $url = $request->query->get('url');

        // ❌ No validation - vulnerable to SSRF

        $response = $this->client->request('GET', $url);

        return new Response($response->getContent());

    }

}

If an attacker sends:

/fetch-remote?url=http://169.254.169.254/latest/meta-data/

It could expose cloud provider metadata — a serious breach.

✅ Secure Alternative with URL Whitelisting

private const ALLOWED_HOSTS = ['example.com', 'api.trustedpartner.com'];

public function safeFetch(Request $request): Response

{

    $url = $request->query->get('url');

    $host = parse_url($url, PHP_URL_HOST);

    if (!in_array($host, self::ALLOWED_HOSTS)) {

        return new Response('Invalid URL', 400);

    }

    $response = $this->client->request('GET', $url);

    return new Response($response->getContent());

}

• Always validate URLs against an allowlist.

• Optionally use DNS resolution to prevent bypasses via IP tricks.
  
  

🛠️ Test Your Website for SSRF (Free Tool)

You can test your Symfony website for SSRF and other OWASP Top 10 vulnerabilities using our Website Vulnerability Scanner.

📌 Screenshot of our tool’s homepage

Screenshot of the free tools webpage where you can access security assessment tools.