SecureSeniorSecurityAuto-graded

Stop a URL fetcher from reaching internal addresses

Anticipating the many ways an address check can be evaded, not just the obvious ones, is what separates candidates.The app has an outbound fetch-this-URL feature — link previews, webhook test pings, avatar imports. The user supplies a URL and your server fetches it, which makes your server a confused deputy: the request originates inside your network, so a hostile URL can reach things the user never could, like a cloud metadata endpoint, an internal admin panel, or a database on localhost. Build the guard that decides which URLs are safe to fetch.

35 min

python

Start lab

You're done when

URLs resolving to private, loopback or link-local addresses are refused — the cloud metadata endpoint included.
Malformed or garbage input is rejected cleanly rather than raising.
The guard raises its defined error when asked to assert that a URL is safe and it is not.

What it measures

Application securityUnderstanding SSRF as a trust-boundary problem, where the danger is which network the request originates from.

Security control testing and evaluationCovering the full set of reserved address ranges rather than blocking a couple of well-known hostnames.

Correct primitivesUsing proper address parsing instead of substring checks, which decoded and alternate notations trivially defeat.

Your environment

Terminal + editorA full shell in the browser

Claude CodePre-authenticated, no key setup

Isolated microVMYours alone, wiped afterwards

Start this lab

35 min

Start labYou'll sign in to Anthropos to start. The lab opens in a private cloud workspace with Claude Code ready to use.

AI Labs is part of Anthropos Workforce. Not on your plan yet? Book a demo