How to remove SSRF vulnerability(CWE ID 918) from http.NewRequestWithContext() function in golang?

Question

We are facing the issue of SSRF vulnerability in http.NewRequestWithContext(ctx, "GET", url, nil) function in Golang during Veracode scan.

The URL that is coming to this function contains jwt token as an additional parameter in the last. eg, https://this.isAValidUrl.com/path?token=--validJwtToken--

We tried to fix the problem in 2 ways by validating the URL using:

1. regex which validates any valid http/https URL.
2. allowed list of specified URLs only.

Both fixes are not working and still we are getting some issues in the Veracode scan. Can someone please help with this?