If I have a an application server that uses an implementation of JAX-RS, and is running as *.war
file on an Apache Tomcat server, is there anything special that needs to be done or configured to prevent SSRF attacks?
My naive understanding is that JAX-RS application are only serving requests to certain URLs and Apache Tomcat only allows requests to certain resources.
If this is handled by default by JAX-RS or Apache Tomcat, could you explain how?
If this is not handled by default by JAX-RS nor Apache Tomcat, could you explain the best way to prevent this type of attack with these tools?
Specific versions:
- JAX-RS api 2.1
- Apache Tomcat 9.0.33