Typical targets are internal services on loopback or a private network. An allow-list of hosts is the usual defense.
SSRF
Server-side request forgery: making the server fetch a URL chosen by the user, so it reaches places the user cannot.
Typical targets are internal services on loopback or a private network. An allow-list of hosts is the usual defense.