Server-Side Request Forgery (SSRF)
Server-Side Request Forgery (SSRF) is a security risk where an attacker can trick a server into making unintended requests to internal or external resources. In an SSRF attack, the attacker can make the server send requests to any URL, including those that access internal networks or services that are normally not publicly accessible.
Cause
With the release of Microsoft Dynamics 365 Business Central 2026 Release Wave 1 (BC 28), measures to prevent SSRF attacks were implemented to enhance the security of the application. These measures include the validation and restriction of URLs provided by users or attackers to ensure they do not access internal resources.
Important
The SSRF prevention feature was introduced in Microsoft Dynamics 365 Business Central 2026 Release Wave 1 (BC 28) and retroactively rolled out to Microsoft Dynamics 365 Business Central 2025 Release Wave 2 (BC 27.2) and Microsoft Dynamics 365 Business Central 2025 Release Wave 1 (BC 26.11).
For more information, refer to the official documentation from Microsoft.
The implementation of SSRF protection measures in Microsoft Dynamics 365 Business Central includes the validation of URLs provided by users or attackers to ensure they do not access internal resources. This validation may result in legitimate requests being blocked in the Direct Connection mode of 365 business Print Agent if the target addresses are not included in the list of allowed URLs.
Solution
Microsoft Dynamics 365 Business Central (On-Premises) provides two configuration options to control the SSRF protection measures:
| Property | Description |
|---|---|
NavHttpClientAntiSSRFEnabled | This property controls the activation of the SSRF protection measures. When set to true, the protection measures are enabled, and requests are validated to prevent SSRF attacks. When set to false, the protection measures are disabled, which can pose a security risk. |
NavHttpClientAntiSSRFAllowedAddresses | This property contains a list of URLs that are exempt from the SSRF protection measures. Requests to these URLs will not be blocked, even if they would normally be considered potentially dangerous. |
Note
It is strongly recommended to enable the SSRF protection measures to ensure the security of your Microsoft Dynamics 365 Business Central environment.
In the Direct Connection mode of 365 business Print Agent, internal HTTP requests are sent by the application to communicate with the 365 business Print Agent clients and trigger print jobs.
To ensure that these requests are not blocked by the SSRF protection measures, the target addresses of the 365 business Print Agent clients must be configured in the list of allowed URLs (NavHttpClientAntiSSRFAllowedAddresses).
This allows the SSRF protection measures to be enabled while ensuring that the communication between Microsoft Dynamics 365 Business Central and the 365 business Print Agent clients functions smoothly without blocking legitimate requests.