Genace
Sign inGet started

image generation API SSRF protection: restrict your own URL-fetching boundary

A generation application often handles two kinds of remote URL: reference images selected by users and output assets returned by jobs. If your backend fetches either URL, that fetch becomes a security boundary. Passing a URL to an upstream provider is a different operation from downloading it inside your own network, and each path needs an explicit policy.

Identify which component actually retrieves bytes

The current Seedance and Nano Banana adapters validate image input strings as URLs and forward the first reference as an upstream image URL. This is not a promise of a comprehensive SSRF filter for every application that uses the API. If your service adds a preview generator, URL validator, or download proxy, you are introducing your own network retrieval behavior.

Prefer application-owned uploaded assets when the product permits it. A user can select an approved asset ID, and your backend can resolve it to a reviewed storage URL. That keeps arbitrary destinations out of the public form and makes authorization and expiry easier to manage.

export function approvedReference(asset, currentTenant) {
  if (asset.tenantId !== currentTenant) throw new Error('Asset access denied');
  if (asset.validationState !== 'ready') throw new Error('Asset not validated');
  const url = new URL(asset.readUrl);
  if (url.protocol !== 'https:' || url.username || url.password) {
    throw new Error('Unexpected asset URL');
  }
  return url.toString();
}

This helper assumes the asset record comes from your trusted database. It is an authorization and syntax gate, not a complete network-layer defense for arbitrary URLs. Do not present it as sufficient protection against DNS changes or every private address encoding.

Enforce policy where connections are made

For a downloader that must support external hosts, define allowed schemes, ports, hostnames, resolved addresses, redirects, and maximum response sizes. Block access to internal services through network controls appropriate to your environment. Validate redirect destinations again and ensure name resolution and actual connection behavior cannot bypass the intended rule.

Keep the fetcher’s network privileges narrow. A general backend that can reach databases, metadata services, and internal dashboards should not automatically become the process that retrieves untrusted references. An isolated media worker or controlled egress proxy can reduce that exposure.

Preserve recovery without relaxing policy

If an output download is blocked, record a local delivery-policy failure while preserving the remote succeeded state. Review the destination rather than opening all network access or resubmitting the generation. If a reference URL is rejected before submission, show a useful input error without creating a job.

Do not log signed URL query parameters while diagnosing access. Store a safe host classification and operation ID, and retain full references only in restricted application storage when necessary.

Acceptance tests

Use isolated fixtures for an approved storage asset, an unauthorized tenant asset, a redirect to a blocked destination, and a hostname resolving to an internal address. Test both URL parsing and the actual network enforcement layer. Confirm failures cannot reach generation submission or expose the API key.

See reference image handling, media redirect policy, and egress controls.

Continue with security

Where these facts come from