SecLab
SSRF & calling external APIswalkthroughDifficulty 3/526 min

An upstream API response is untrusted input

Objective: After this lesson you treat an upstream API response with the same suspicion as a request from the Internet.

V13API10:2023A10:2025api-security
Step 1 of 5 · read5 min

Why "the partner API" is not a trust boundary

Every developer validates input from users. Very few validate the response from an upstream API — and API10 exists for that reason.

The reason for skipping it sounds sensible: "that is our partner's API, we have a contract". But a contract is not a technical control, and there are four ways that response turns malicious without your partner intending anything:

RouteExample

The partner is compromised | m6-challenge itself — their pipeline, not their intent |

| MITM on the route to them | tls-and-transport, the => true line |

| Your own SSRF | You think you are calling the partner; you are calling wherever the attacker chose |

| The partner changes the contract | Not malicious, same consequence: the response is not what you assumed |

The third row is the most notable because it ties this module together: if you have SSRF then every assumption about "the partner's response" becomes an assumption about "the attacker's response". The two holes multiply rather than add.

Five commonly made and commonly wrong assumptions:

AssumptionHow it breaks
The response is valid JSONAn HTML error page, or a different Content-Type
A reasonable sizeA 4 GB response exhausting process memory
It returns within secondsAn infinitely slow drip holding your connection and thread
Fields have their documented types"amount": "1e999", "id": null where required
Strings in it are safe to renderIt reaches innerHTML and becomes XSS

The third row deserves its own note because it is not a data problem but a resource-exhaustion attack: a server sending one byte every 20 seconds holds one of your threads indefinitely, and HttpClient.Timeout defaults to 100 seconds for the whole request — but it does not bound body-read time if you stream it.

View path

Comments

Join the discussion
Sign up to comment

Commenting needs an account with at least one completed lesson. That condition is what keeps this thread worth reading: every point belongs to someone who can be asked back, and reputation accrues over time.

Sign upSign in

You can still read every comment below without an account. Signing in brings you back to this exact spot, not to the top of the page.

Loading comments…