ASVS 5.0 V13.2.5 requires that the web or application server is configured with an allowlist of resources or systems to which it can send requests or from which it can load data or files. It is Level 2. Where V13.2.4 is about the policy, this one is about the server configuration that enforces it.
Why it matters
Server components load things too: proxy upstreams, include directives, XML external entities, image processing, template includes. A configuration that lets these reach any URL gives attackers a way to read internal files or services.
How to implement it
Pin proxy targets explicitly and avoid variables built from request data.
nginx, safe upstream:
upstream partner_api {
server api.partner.example:443;
}
location /partner/ {
proxy_pass https://partner_api/;
}
Unsafe pattern to avoid:
# proxy_pass $arg_target; attacker chooses the destination
Other switches: disable external entity resolution in XML parsers, turn off remote file includes in PHP (allow_url_include=Off, allow_url_fopen=Off where possible), and restrict the server host with a firewall egress rule.
How to test it
Review config for any proxy_pass, fetch or include that uses request input. Then probe: request a path that would make the server contact an unlisted address and watch for a block in logs and at the firewall.
Common mistakes
- A debugging proxy location left in production config.
- Resolver settings that let nginx reach internal DNS names for any host.
- Relying on the app allowlist while the server itself can reach everything.
Quick check
What is an example of server configuration that breaks this requirement?
A reverse proxy location whose destination comes from a request parameter.
