If the code that reaches internal services is explicitly different from the code that reaches the public internet, an application cannot be tricked into SSRF.

First, we can now restrict the global fetch() function to accept only publicly-routable URLs. This makes applications totally immune to SSRF attacks! You cannot trick an application into accessing an internal service unintentionally if the code to access internal services is explicitly different.