security: add 6.28 Prevent Server-Side Request Forgery (SSRF) #292 Update

[jp-bmn]

• Add sections/security/prevent-ssrf.md with full best practice doc:

  • One Paragraph Explainer covering attack vectors (metadata endpoints, internal services, file://, DNS rebinding)
  • Vulnerable code example with annotated attacker payloads
  • Safe code example: WHATWG new URL() parse, protocol + domain allowlist, ssrf-req-filter DNS resolution, redirect: 'error'
  • Node.js 20+ --experimental-permission --allow-net defence-in-depth
  • 9-point defence checklist including redirect-bypass and url.parse() deprecation warnings
  • OWASP + Snyk blog quotes
  • Update README.md:
  • Section 6 count: 25 -> 26
  • Add 6.28 ToC entry with #new tag
  • Add 6.28 section body with OWASP A10:2021 SSRF badge

  What The New Section Covers

sections/security/prevent-ssrf.md follows the repo template exactly:

• One Paragraph Explainer — defines SSRF, explains why Node.js is specifically exposed (idiomatic outbound HTTP calls via fetch/axios/http.request), lists concrete attack vectors (AWS metadata endpoint 169.254.169.254, internal services, file:///gopher:// protocol abuse), and states the three-layer defence. Warns explicitly against the deprecated url.parse() in favour of the WHATWG new URL() constructor.

• Code Example – vulnerable — a minimal Express route where req.query.url flows directly into fetch(), with four real attacker payloads shown as comments (AWS IAM credentials, internal service, /etc/passwd, Redis via gopher).

• Code Example – defence in depth — the same route hardened with four sequential guards: WHATWG URL parsing, https: protocol enforcement, domain allowlist via Set, and DNS-resolution blocking via ssrf-req-filter. Redirects are disabled (redirect: 'error') to prevent open-redirect bypass.

• Code Example – Node.js 20+ runtime flag — shows --experimental-permission --allow-net= as a defence-in-depth layer with a clear note that it is experimental and complements, not replaces, application-level validation.

• Defence checklist — nine actionable items covering: no raw user URLs, allowlist over blocklist, https: only, new URL() over url.parse(), DNS resolution before connect, DNS-rebinding mitigation, redirect re-validation, eslint-plugin-security in CI, and the Node 20+ permission model.

• Two blog quotes — OWASP SSRF Prevention Cheat Sheet and Snyk Blog (SSRF in Node.js), per the repo's evidence-based writing guideline.

---

Why This Was Prioritized

SSRF is OWASP A10:2021 — a named, ranked vulnerability class that nodebestpractices currently does not address at all. Any developer following this guide to secure their Node.js application has no guidance on a class of attack that can directly expose cloud credentials, internal services, and running-process secrets. The attack surface is particularly sharp for Node.js because fetch() and axios are idiomatic and the mistake is easy to make without realising it.
Although the ticket has been open for 8 years now, there is no issue in verifying the security standards of the current model and improving functionality.

Closes open SSRF ticket (originally filed 2018, now addressed for Node.js 2024 edition using native fetch, WHATWG URL API, and the Node 20 Permission Model).