Evidence search
Search
Search titles, summaries, topics, providers, authors, and the full open-access corpus.
Results for “SSRF”
7 publicationsTune managed WAF rules without opening a bypass
Fix a managed WAF false positive by changing one rule for one route, then decide what happens to the request body bytes AWS WAF, Azure WAF and Cloud Armor never inspect.
Workload security · Amazon Web Services / Microsoft Azure / Google Cloud · By Cloud Security DeskRequire authentication between Cloud Run services
Configure Cloud Run service-to-service authentication with a dedicated caller identity, the right ID token audience, and useful negative tests.
Workload security · Google Cloud · By Cloud Security DeskIsolate document parsing before RAG ingestion
Give document parsing a bounded worker, then admit its extracted content separately before embedding or indexing.
AI systems · Apache Tika / Kubernetes / gVisor · By Cloud Security DeskChoosing isolation for a Kubernetes tenant
A namespace, a virtual control plane and a sandboxed runtime protect different boundaries. Start with tenant authority before choosing the cluster architecture.
Workload security · Kubernetes / gVisor / Kata Containers · By Cloud Security DeskDesign an outbound fetch service that contains SSRF
A URL check is only the first decision. The fetch worker must contact the approved destination, recheck redirects and limit the authority of every request.
Workload security · OWASP / IANA · By Cloud Security DeskModel output needs its own trust boundary
A model can produce valid JSON containing an unauthorized identifier, an unsafe link or text that a renderer interprets as code. The application consuming that output owns the next trust decision.
AI systems · OpenAI · By Cloud Security DeskRequire EC2 IMDSv2 without breaking container credentials
Separate metadata token requirements from response hop limits, then verify both existing instances and future launches before declaring the migration complete.
Workload security · AWS · By Cloud Security Desk