If your app lets a user paste in a URL — a link preview, a "import from website" button, an AI agent that browses the web on someone's behalf — you have a Server-Side Request Forgery (SSRF) problem whether you've thought about it or not. This post walks through exactly why naive URL fetching is dangerous, why the obvious fixes don't work, and how to actually close the hole.
The naive approach (and why it's broken)
Most "fetch a URL and extract data from it" code looks like this:
import requests
def fetch(url: str):
