Glossary
Server-Side Request Forgery
Server-side request forgery tricks a server into making a request to a destination on the attacker's behalf — often an internal resource the attacker has no direct access to, but the server, sitting inside the network, does. A feature that legitimately fetches a URL supplied by a caller, such as generating a preview of a linked page, can be abused to make the server issue requests to internal systems the caller was never authorized to reach on their own.
This is a specific, extremely common web-application instance of the confused deputy problem: the server has more network reach than the caller does, and a request that looks like an ordinary fetch is actually borrowing the server's own broader access to reach somewhere the caller couldn't have gone directly. Defending against it means treating a server-side fetch of a caller-supplied destination as exactly as untrusted as any other caller input, not as an internal operation exempt from scrutiny.