Glossary · Phase 8 · APIs

SSRF

Also written: server-side request forgery

Tricking a server into sending requests to places it shouldn't, such as its own internal network.

Try it now

Delivery is at least once. Handling the same event twice must do no harm.

Webhooks and events · Push events to other systems: signed, retried and deduplicated. About 40 minutes.

replay attack: Recording a genuine message and sending it again later. Signed timestamps defend against it.

Teach a small one to write, right in your browser. It takes about 20 seconds and needs no account.