Why URL Blocklists Fail Against SSRF and How to Fix It Properly

Web applications that allow users to submit URLs for fetching — such as link previews or web import features — are inherently vulnerable to Server-Side Request Forgery (SSRF) if not handled carefully. A common but flawed fix involves resolving a hostname and validating its IP before fetching, yet the actual HTTP request performs a second DNS lookup independently, creating a DNS rebinding window attackers can exploit. By briefly serving a legitimate IP during validation and then flipping the DNS record to an internal address like the cloud metadata endpoint 169.254.169.254, an attacker can bypass the check entirely. Automatic redirect-following compounds the risk, as redirect targets are typically never re-validated against blocked ranges. The only reliable mitigation is to resolve DNS once, validate the resulting IP, force the HTTP connection to that exact IP, and repeat this process for every redirect hop in the chain.