Quick answer
An SVG is active XML-capable markup rather than a harmless bitmap. Reject scripts, event handlers, foreign objects, external resources and unsafe URL references before preserving an uploaded SVG in a package.
- Last verified
- July 31, 2026
- Evidence
- Primary documentation plus transparent editorial analysis
- Primary sources
- 3
Favicon Security: SVG Uploads, SSRF and Tracking: key distinctions
| Boundary | Required control |
|---|---|
| SVG upload | Reject active content and external resources |
| Raster upload | Decode with byte, dimension and memory limits |
| URL checker | Block private networks before and after redirects |
| Operational data | Minimize retention and document processing |
Treat uploaded artwork as untrusted
An SVG is active XML-capable markup rather than a harmless bitmap. Reject scripts, event handlers, foreign objects, external resources and unsafe URL references before preserving an uploaded SVG in a package.
Decode raster files with size limits and trusted image libraries. Validate actual bytes and dimensions instead of relying on extensions or client-supplied MIME values.
Connected next stepFavicon MIME Types for ICO, SVG, PNG and Manifests for the closest prerequisite or comparison.
Prevent server-side request forgery
A public favicon checker accepts a URL and makes server-side requests, so it must reject localhost, private, loopback, link-local and other non-public destinations. Apply the same validation after DNS resolution and across redirects.
Restrict schemes to HTTP and HTTPS, enforce response and download limits, set timeouts and avoid forwarding user credentials or internal headers.
Connected next stepApple Touch Icons: Size, Markup, and Cropping for the next connected implementation decision.
Understand favicon tracking risk
Researchers have demonstrated durable browser-identification techniques using favicon caches and redirect patterns. A normal site icon is not automatically a tracker, but operators should avoid using favicon state as an opaque cross-session identifier.
Document what the application stores, minimize logs, and keep optional account behavior separate from anonymous generation. Do not embed third-party scripts merely to measure icon interactions.
Connected next stepOpen the most relevant production tool and verify the decision with a working output.
Publish security boundaries
Explain whether editing occurs locally, when bytes reach the server, whether uploads are retained, which public URLs a checker requests and how private networks are blocked. Clear boundaries help users choose appropriate artwork and workflows.
Add regression tests for malicious SVG, decompression limits, redirect-to-private targets, misleading Content-Type responses and oversized ICO directories.
Apply this guide with the relevant tools
Use the smallest tool that verifies the specific decision described above. Each destination keeps the source format, deployment evidence, or platform purpose explicit.
Review the headings, sources, implementation artifact, and update record for this guide as structured JSON.
Download guide evidence ↓- Guide
- Favicon Security: SVG Uploads, SSRF and Tracking
- Coverage
- Client behavior can change by browser, operating system, platform version, cache state and deployment configuration. Unperformed manual observations are not claimed.
Questions, answered
Can an SVG favicon contain JavaScript?+
SVG can contain active features, so a generator that preserves uploads should reject scripts, event handlers and external resources.
Can a favicon checker access localhost?+
It should not. Public checkers must block loopback, private and non-public network destinations, including redirects to them.