The Laravel Guide to SSRF Defense That Survives Redirects

A hostname allowlist helps at input time. The real attack starts after your server sends the request.