DeepFrontend
Learning Paths
Practice
System Design & DS
Design Studio
Data Structures Curriculum
Real-World Case Studies
Careers
Job Board
Resume Builder
Blog
Sign in
Search
⌘K
Go Pro
Loading compiler resources...
Web Security Quiz Practice
Active Recall Drill Session
← Exit Session
Question 1 of 1
medium
Web Security
A code review finds an image-proxy endpoint that calls fetch() directly on a client-supplied URL with no validation. What should be flagged?
A
Nothing — fetching images is always safe
B
SSRF — the server can be tricked into fetching internal-only addresses (cloud metadata, internal services) that the client could never reach directly
C
This can only be an XSS concern, not SSRF
D
This is safe as long as HTTPS is used for the client's own connection
Check Answer