Internal services should require the same authentication that external services do. “It’s only reachable internally” is not an authentication scheme:

• Admin panels should require authentication from all callers, including internal IPs

• Microservices should use mTLS, API keys, or service mesh authentication (Istio, Linkerd) for service-to-service calls

• Redis, Elasticsearch, and database interfaces should require passwords even inside the VPC

• Kubernetes API server should require valid service account tokens, not open to internal callers

The internal network perimeter assumption breaks in multiple ways: SSRF (this module), compromised internal host, supply chain attack on an internal service, container escape in a shared cluster. Any of these puts an attacker “inside” where internal-trust services are open. If every internal service requires authentication, the SSRF attacker can reach the service but can’t authenticate to it — limiting the damage to a network probe rather than a data breach.

MIT 05 is one component of zero trust networking — the principle that no request is trusted based on network location alone. Every request, from any source, must present a valid credential. SSRF that can only probe open ports on internal services that all require auth is far less dangerous than SSRF that can call unauthenticated admin endpoints.