Synthetic teaching example for a website delivery brief. Not a client result, live account test or certification.
The convenience feature changes the server’s trust boundary
A website content tool that accepts “paste an image URL” can cause the server to make a request on someone else’s behalf. That is different from displaying a text link. Before commissioning remote imports, ask which destinations are permitted and what prevents the tool from contacting an internal or redirected destination.
| Fictional input | Finite result | Meaning |
|---|---|---|
| https://assets.example.test/a.png | NEEDS_CONNECTION_POLICY_NOT_SAFE | Exact input host permitted; no request made |
| http://assets.example.test/a.png | REJECT_INPUT | Outside HTTPS-only brief |
| https://assets.example.test@127.0.0.1/a.png | REJECT_INPUT | User-info is not the host |
| https://127.0.0.1/a.png | REJECT_INPUT | Not an allowed host |
| https://assets.example.test.evil.example/a.png | REJECT_INPUT | Suffix resemblance is not equality |
Use the filled example
Download the finite Node checker and filled input. Run with Node 24 or newer; no account, API or network is used.
node checks.mjs remote-image-intake-boundary remote-image-intake-boundary.jsonExpected output has four rejected inputs, one unresolved connection-policy result and networkRequests 0. The accepted-looking hostname is intentionally a reserved test name, not a service to contact. The checker uses standard URL parsing and an exact hostname list; it does not resolve DNS or follow redirects.
What is still missing after a hostname check?
Require a reviewed policy for resolved destination addresses, DNS changes, connection routing, TLS identity, ports and redirect targets. A destination can pass a string comparison while resolving somewhere forbidden. Size limits, timeouts and content verification also need explicit implementation. Do not let a successful parse become a green “safe” label.
Ask the supplier to demonstrate allowed and blocked paths inside an authorised test environment, without probing third-party or private infrastructure. Keep credentials out of pasted URLs and logs. An initial host allowlist is one layer, not proof against DNS rebinding or every server-side request forgery path.
This teaching file makes zero network requests and changes no importer. It is not a security scanner, exploit kit or safe-fetch library. A production feature must be reviewed and tested at the actual connection layer before activation.
Primary facts and limits
OWASP SSRF prevention: Discusses destination allowlists, redirects and DNS-related risks; input validation alone is not connection safety.
Sources reviewed 15 October 2026. The supplied input and acceptance rules are original teaching design; check current platform versions and your actual delivery contract before implementation.