What PHP is allowed to make this Worker fetch on its behalf.
cfwFetch and cfwQueueFetch take a URL from PHP, so any module can choose the destination
(SSRF with the Worker as confused deputy: metadata endpoints, localhost under wrangler dev).
A deny-list, not an allow-list: the legitimate set is open-ended (update servers, OIDC
providers, webhooks) and an allow-list would need editing to install a module.
What PHP is allowed to make this Worker fetch on its behalf.
cfwFetchandcfwQueueFetchtake a URL from PHP, so any module can choose the destination (SSRF with the Worker as confused deputy: metadata endpoints,localhostunderwrangler dev). A deny-list, not an allow-list: the legitimate set is open-ended (update servers, OIDC providers, webhooks) and an allow-list would need editing to install a module.