Training Trains Internship
Student login
← Web Application Security (OWASP) learning path
Web Application Security (OWASP) · Module 9 of 10

Logging, monitoring and SSRF

Detect problems and control server-side requests.

📖 Key ideas

  1. Log security events: logins, failures, permission denials, admin actions.
  2. Protect logs from tampering and exclude sensitive data.
  3. Alert on unusual activity.
  4. Server-side request forgery (SSRF) risk: servers fetching user-supplied URLs.
  5. Prevent SSRF with URL allow-lists and blocking internal addresses.
💡 Real-life example: Security logging is CCTV: you can't investigate what you never recorded.
Security loggingRecording security-relevant events
AlertingNotifying on suspicious activity
SSRFServer-side request forgery
Allow-listOnly approved destinations