Java Tech Workshop

Sep 17, 2026 · Backend Development

Spring Boot 4.1 InetAddressFilter: Source-Level SSRF Protection Against Internal IPs & Cloud Metadata

This article dissects Spring Boot 4.1's built-in InetAddressFilter, showing how a single @Bean declaration blocks SSRF attacks by validating resolved IPs against private, loopback, link-local (including 169.254.169.254 cloud metadata), and multicast ranges before TCP connections are made, with automatic integration across RestClient, RestTemplate, and WebClient.