What it asks for. This category covers flaws where a web application fetches a remote resource based on a URL supplied by the user without validating it. An attacker can then make the server send requests to internal systems, cloud metadata services or other destinations that should not be reachable.
In practice. Strong defences combine network and application controls. At the network layer, the components that make outbound requests are segmented and restricted with deny-by-default egress rules. In the application, user-supplied URLs are validated against an allow list of schemes, hosts and ports, redirects are not followed blindly, and raw responses are not returned to the client. Cloud instance metadata services are hardened, for example by requiring session tokens. Evidence includes code review findings, security tests covering SSRF payloads and documented egress rules.
Common gaps. Teams often rely on deny lists or regular expressions that can be bypassed with alternative IP encodings, DNS rebinding or redirects. Webhooks, file importers and URL preview features are frequently overlooked.