3 ms·
SSRF is a tremendous problem with webhooks. Stripe also solves this: https://fly.io/blog/practical-smokescreen-sanitizing-your-outbound-web-requests/ https://fl
by mrkurt 6y ago
SSRF is a tremendous problem with webhooks. Stripe also solves this: https://fly.io/blog/practical-smokescreen-sanitizing-your-outbound-web-requests/ https://fly.io/blog/practical-smokescreen-sanitizing-your-ou...
- grinich 6y agoAgreed, I should add something on this. (Haven't updated the article since posting it many months ago.)
- alexsmolen 6y agoThis is a pretty good article about preventing SSRF including DNS rebinding-based attacks in Go https://www.agwa.name/blog/post/preventing_server_side_request_forgery_in_golang https://www.agwa.name/blog/post/preventing_server_side_reque...
- tasn 6y agoYeah, it's one of the thing that people miss when implementing webhooks naively, and I bet it's one of the things people miss when consuming them!