SSRF Prevention in C#: Securing File Imports From User-Supplied URLs

A document portal that accepts a URL saves users the trouble of downloading a file and uploading it again. That’s particularly useful when large, complex, or sensitive documents are already hosted online. With URL upload as an option, external business partners like vendors or suppliers can submit links to files like compliance reports or product specification sheets, which our application can subsequently download for review.

That convenience comes with risk, of course. If we treat syntactically valid URLs as automatic permission to connect with our server, our file-import feature quickly becomes a Server-Side Request Forgery (SSRF) vulnerability. SSRF attacks occur when bad actors craft URLs to trick our server into accessing internal services they couldn’t reach directly otherwise.