Security · Guide
Do not let an AI-generated URL become network authority
Bound where document-fetching and research tools can connect.
Fetching a link has consequences
In an illustrative supplier-research workflow, a user uploads a document containing a URL and the assistant fetches it automatically. The URL may point somewhere the application can reach but the user should not. Treat URL fetching as a network capability, not harmless text handling. OWASP’s SSRF material provides the threat context. Our recommendation is to define approved destinations and protocols according to the actual research task.
Choose a bounded browsing mode
For a workflow that only checks known supplier sites, allowlist those destinations and validate the final resolved destination as well as the initial URL. For broad research, isolate the fetcher from internal services and sensitive credentials, and constrain response size, redirects, and time. A generic fetch-anything tool should not share the application’s privileged network position. The right design depends on whether open-ended retrieval is genuinely necessary.
Workflow at a glance
Handle content as untrusted data
A successfully fetched page may contain instructions, forms, or links that ask the agent to send information elsewhere. Retrieval permission is not permission to submit data. Keep extraction read-only, strip active behavior in previews, and pass only required content onward. Test redirects and oversized content with harmless controlled endpoints. Do not build a test that probes unrelated internal networks or real third-party systems without authorization.
Record a useful refusal
When a link is outside the allowed scope, return a clear state that asks the operator for an approved source or manual review. Do not silently omit the source and generate a confident answer. Record the reason class without exposing signed URLs or credentials. Restricting destinations can reduce coverage, so make that tradeoff visible in the service description. A narrower, explainable research workflow is often more valuable than unrestricted fetching with unclear risk.
Own the destination list
Maintain approved destinations as versioned configuration with an owner. A supplier domain move should trigger validation, not an unrestricted exception. Give staff a source-request path describing business purpose and data involved, and periodically remove destinations that no longer support an active workflow.
Sources and further reading
- Server-Side Request Forgery Prevention Cheat SheetServer-Side Request Forgery Prevention Cheat SheetOWASP · Documentation ·
- LLM Prompt Injection Prevention Cheat SheetLLM Prompt Injection Prevention Cheat SheetOWASP · Documentation ·
Editorial approach
AI-assisted original writing, checked against linked public sources. Practical recommendations and illustrative scenarios are editorial analysis, not reported client results. Source dates and product details may differ from this collection’s preparation date.