An outbound proxy is an intermediary that monitors or mediates requests from an application to external services. It can inspect API calls, evaluate risk, monitor dependency health, and return useful errors when an external service fails. section 5.2 section 5.7
Use an outbound proxy to:
- Inspect user-provided URLs and evaluate their risk before allowing requests. section 5.2
- Help isolate webhook requests from localhost, internal networks, and sensitive endpoints. section 5.2
- Monitor third-party API health and support circuit breaking when dependencies time out or return errors. section 5.7
Figure 5.4 Webhooks are among the most common vectors of SSRF attacks. In this example, a threat actor configures a webhook to scan the local network for a service running at http://localhost:8080/jobs.
A webhook configured to call http://localhost:8080/jobs can let an attacker probe services on the local network; routing such requests through a controlled outbound proxy supports risk evaluation. section 5.2
