Hacker News Reader

SSRF is a tremendous problem with webhooks. Stripe also solves this: https://fly.io/blog/practical-smokescreen-sanitizing-your-ou...

Agreed, I should add something on this. (Haven't updated the article since posting it many months ago.)

This is a pretty good article about preventing SSRF including DNS rebinding-based attacks in Go https://www.agwa.name/blog/post/preventing_server_side_reque...

Yeah, it's one of the thing that people miss when implementing webhooks naively, and I bet it's one of the things people miss when consuming them!