I have found a server side request forgery (SSRF) vulnerability in a website, In the request body; there is a JSON Object called "html" which reflect in a PDF file with download link starts with https://storage.googleapis.com/../, when I tried to change this HTML code with <iframe src="http://my-burp-collaborator.net> I could receive HTTP response from internal IP,

then I tried to put this src=http://metadata.google.internal/computeMetadata/v1/ I got a message inside the frame: "Missing required header: Metadata-Flavor", which should be Metadata-Flavor: Google, then I tried many methods like, <meta name='Metadata-Flavor' content='Google'>, http://metadata.google.internal/computeMetadata/v1/?Metadata-Flavor=Google, Any one have an idea how to bypass this! Thanks!