Expert · Web attacks and their fixes · topic 24 of 35 · 20 min
SSRF and authentication flaws
Explanation
SSRF: making the server fetch for you
Server-side request forgery (SSRF) happens when an app takes a URL from the user and fetches it on the server, without restricting where it can go. Because the server often sits inside a trusted network, an attacker can make it request internal addresses that they could never reach directly — for example internal admin pages or cloud metadata services.
- Fix: allow only a strict list of known, external destinations; reject internal addresses and unexpected schemes.
- Fix: do not send the raw response back to the user; fetch server-side with tight limits.
- Detection: outbound requests from the server to internal or unusual addresses in logs.
Authentication flaws
Authentication is proving who you are. Common flaws: no limit on password guesses (so attackers can try many), weak password rules, passwords stored unsafely, sessions that never expire or are easy to steal, and weak or missing multi-factor authentication. Each makes it easier for an attacker to become a legitimate user.
| Weakness | Fix |
|---|---|
| Unlimited login attempts | Rate limiting and account lockout/backoff |
| Weak or reused passwords | Strong password policy; check against known-breached lists |
| Passwords stored in plain text | Hash with a slow algorithm (bcrypt/Argon2) and a salt |
| Sessions that never end or leak | Short expiry, secure + HttpOnly cookies, rotate on login |
| No second factor | Offer and encourage multi-factor authentication (MFA) |
Detection and defence
Detection: many failed logins from one source (credential stuffing or brute force), logins from odd locations, and sudden spikes. Defence: rate-limit and monitor the login, hash passwords properly, handle sessions securely, and offer MFA. These are also exactly the OWASP "Identification and authentication failures" items — the attack and the fix are two sides of the same list.
Need help?
Stuck on a word or an idea? Search this course, or every course, and jump straight to the explanation or a worked question.
Try:
Watch the lesson
SSRF and authentication flaws · 1/7
SSRF: the server fetches a URL the attacker chooses, maybe reaching internal systems.
Prefer a video by a teacher? Find free videos on “ssrf and authentication vulnerabilities explained with fixes” on YouTube ↗
In real life: Locking the front door
A lab app lets a learner try passwords endlessly and stores them in plain text. He reports two findings: add rate limiting plus lockout so guessing is impractical, and hash passwords with bcrypt and a salt so a database leak does not reveal them. He also finds a URL-fetch feature with no restrictions (SSRF) and recommends an allow-list of external destinations. Every finding names the OWASP category and a concrete fix.
Practice (0/3 done)
SSRF tricks the server into…
Passwords should be stored…
Model an SSRF allow-list check. Write allowed(host, allowlist) that returns True only if host is in the allowlist (a list of permitted hostnames), else False.
Quick quiz
Read more (free)
Related help
Before this, learn
This topic builds on these. If something here feels new, open them first.
Related topics
- Passwords and multi-factor authenticationCyber Security: from zero to SOC analyst · Security basics
- Signup and login end to endFull-Stack Development · Authentication and files end to end
- Password hashing and cracking (your own hashes only)Deeper lab skills: passwords, privilege, Metasploit, wireless
- Storing passwords safelyBackend Development · Authentication and authorization
- Security basics: threats, CIA and AAAComputer Networking (CCNA level) · Network security
- Hashing: fingerprints for dataCyber Security: from zero to SOC analyst · Systems and cryptography
Questions people ask about this
Open a question to see the answer and why. The first ones are this topic's own quiz, so try the quiz above before you peek.
The main fix for SSRF is…
Answer: Allowing only known destinations and blocking internal addresses
Restricting where the server may fetch stops SSRF.
Rate limiting the login defends against…
Answer: Endless password guessing (brute force/stuffing)
Limiting attempts makes guessing impractical.
A salt in password hashing is…
Answer: Extra random data so identical passwords hash differently
A salt makes each hash unique and defeats precomputed tables.
MFA (multi-factor authentication) adds security by…
Answer: Requiring a second factor beyond the password
A second factor protects even if the password leaks.
Which password is strongest?Related
Answer: river tiffin kite seventeen lamp
A long passphrase of random words has far more possible combinations and is not in common lists.
After login, how does the server know who sends GET /api/notes?Related
Answer: The browser sends the session cookie automatically and the server looks it up
The browser stores the cookie and sends it with each request to the same site; the server finds the session row and its user id.
Even a cracked password matters less when the account has…Related
Answer: Multi-factor authentication
MFA requires a second factor beyond the password.
Stored XSS differs from reflected XSS because it…Related
Answer: Is saved on the server and shown to many viewers
Stored XSS persists and affects every viewer of the page.
Pass the quiz (60% or more) or mark this topic as done when you are ready.
Your progress is saved on this device only.
Next steps
- This is the last topic of “Web attacks and their fixes”. The module exam comes next.
- Module 7 exam: web attacks and fixes · 13 questions · 22 min, without help. 4 topics of this module still to finish first.
- Then the next module, Deeper lab skills: passwords, privilege, Metasploit, wireless. 35 topics left in the course before the final exam.