// Topic

ssrf

1 post · all topics

· 3 min · intermediate
Why SSRF blocklists keep failing

A blocklist has to be right about every address a URL might resolve to. An allowlist only has to be right about the ones you meant. Here's why that asymmetry decides the outcome.