Before making any outbound request, resolve the target hostname to its IP address. Check the resolved IP against forbidden ranges. If the IP is in a forbidden range, reject the request with an error. Do not make the HTTP request.

Forbidden IP ranges to block:

• RFC 1918 private: 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16

• Loopback: 127.0.0.0/8, ::1

• Link-local (cloud metadata): 169.254.0.0/16, fe80::/10

• Unroutable / reserved: 0.0.0.0/8, 100.64.0.0/10, 192.0.0.0/24, 240.0.0.0/4

An attacker controls evil.attacker.com. At check time, the DNS record returns a public IP (passes the check). At fetch time, the DNS record returns 169.254.169.254 (the actual target). The fix: resolve once, validate the resolved IP, then make the request to the resolved IP directly — not to the hostname. This ensures the IP that was validated is the IP that receives the connection.

Use a security-aware HTTP client library or SSRF middleware (e.g., ssrf-req-filter for Node.js, python-ssrf patterns, or dedicated WAF rules) rather than implementing IP validation from scratch. DNS resolution + IP validation + fetch must be atomic — if there’s a gap between validation and fetch, DNS rebinding works.