How to fix Server-side Request Forgery x2 in ASP.NET MVC?

Question

How to maintain a whitelist of externally requested services and hosts and block any interactions that do not appear on the whitelist?

I am looking for some code snippet for implementation of this.

Answer 1

you can create an ActionFilter, which will check the request host/ip address, compare which db and block request when not found.

public class WhiteListedOnlyAttribute : ActionFilterAttribute
{
    public override void OnActionExecuting(ActionExecutingContext context)
    {
        var ipaddress = getHost(context);

        if(isValid(ipaddress))
        {
           base.OnActionExecuting(filterContext);
           return;
        }
        else
        {
           context.Result = RedirectToRouteResult(...);
        }
    }
}