{
  "node_id": "owasp-api-top-10-2023-api07-server-side-request-forgery",
  "title": "API7:2023 Server Side Request Forgery",
  "domain": "Cybersecurity",
  "version": "1.0.0",
  "last_updated": "2023-06-13",
  "bluf": "OWASP API Security Top 10 (2023) API7:2023 Server Side Request Forgery. Server-Side Request Forgery (SSRF) flaws occur when an API is fetching a remote resource without validating the user-supplied URL. It enables an attacker to coerce the application to send a crafted request to an unexpected destination, even when protected by a firewall or a VPN. Modern concepts in application development make SSRF more common and more dangerous. More common - the following concepts encourage developers to access an external resource based on user input: Webhooks, file fetching from URLs, custom SSO, and URL previews. More dangerous - Modern technologies like cloud providers, Kubernetes, and Docker expose management and control channels over HTTP on predictable, well-known paths. Those channels are an easy target for an SSRF attack. It is also more challenging to limit outbound traffic from your application, because of the connected nature of modern applications. The SSRF risk can not always be completely eliminated. While choosing a protection mechanism, it is important to consider the business risks and needs. This category sits within the OWASP API Security Top 10 (2023 edition), the canonical industry list of the ten most critical API security risks. Organizations implementing API services should treat each of the ten categories as both a design constraint and a continuous-monitoring obligation, with policies, automated testing, and incident response procedures defined per category.",
  "paywall": {
    "status": "LOCKED",
    "unlock_cost_usd": "0.01",
    "skyfire_id": "41779894-ece2-4163-9761-b3b1b76e19b0"
  },
  "crosswalks": {
    "_available_keys": [
      "nist_framework",
      "iso_standard",
      "industry_mapping",
      "ai_overlay_2026"
    ],
    "_note": "Full crosswalk values included in vault response"
  },
  "dependencies": [
    "owasp-asvs-l1",
    "owasp-asvs-l2",
    "nist-sp-800-53-r5",
    "iso-27001-2022"
  ],
  "primary_citations_count": 12
}