Directly incorporating user input in the URL of an outgoing HTTP request

can enable a request forgery attack, in which the request is altered to

target an unintended API endpoint or resource.

If the server performing the request is connected to an internal network, this can give an attacker

the means to bypass the network boundary and make requests against internal services.

A forged request may perform an unintended action on behalf of the attacker, or cause information

leak if redirected to an external server or if the request response is fed back to the user.

It may also compromise the server making the request, if the request response is handled in an unsafe way.

Restrict user inputs in the URL of an outgoing request, in particular:

<ul>

<li>

Avoid user input in the hostname of the URL.

Pick the hostname from an allow-list instead of constructing it directly from user input.

</li>

<li>

Take care when user input is part of the pathname of the URL.

Restrict the input so that path traversal ("<code>../<code>")

cannot be used to redirect the request to an unintended endpoint.

</li>

</ul>

being used directly in the URL of a request without validating the input,