---
name: validate-ssrf
description: Evidence bar for server-side request forgery, reflected and blind, and the access a request primitive supports. Use when validating a finding that claims the server can be made to send requests.
---

# Validate server-side request forgery

- Describe the request control relevant to the finding and whether the response is reflected or blind. A callback or open-port signal alone establishes only a request primitive.
- Limit access claims to the destination and response supported by the evidence; reachability alone does not establish privileged actions or command execution.
- For blind SSRF, preserve the triggering request and matching unique event. Avoid broad internal scanning.
- Reaching cloud credentials demonstrates the impact; never use them against cloud APIs.