---
title: "You should know about Server-Side Request Forgery"
description: "Server-side request forgery (SSRF) lets attackers make an application server issue HTTP requests, potentially reaching internal resources behind its security perimeter and taking over the hosting environment. The post describes two common patterns—user-supplied URLs and user data incorporated into URLs—and presents Smokescreen, an egress proxy, as a mitigation. Smokescreen checks that requested IP addresses are publicly routed, blocking private IPv4 ranges and IPv6 ULA space, while ACL actions can open, report, or enforce traffic rules. The Fly modification authenticates clients with a shared PROXY_PASSWORD, maps authenticated requests to an authed role, and includes deployment instructions for Fly and Docker plus Go and Node.js examples that send authenticated HTTPS requests through the proxy."
---

# You should know about Server-Side Request Forgery

[Fly.io](https://yomu.fyi/company/fly-io) · Feb 5, 2021

**Type:** Tutorial

## Summary

Server-side request forgery (SSRF) lets attackers make an application server issue HTTP requests, potentially reaching internal resources behind its security perimeter and taking over the hosting environment. The post describes two common patterns—user-supplied URLs and user data incorporated into URLs—and presents Smokescreen, an egress proxy, as a mitigation. Smokescreen checks that requested IP addresses are publicly routed, blocking private IPv4 ranges and IPv6 ULA space, while ACL actions can open, report, or enforce traffic rules. The Fly modification authenticates clients with a shared PROXY\_PASSWORD, maps authenticated requests to an authed role, and includes deployment instructions for Fly and Docker plus Go and Node.js examples that send authenticated HTTPS requests through the proxy.

## Context

The post addresses the danger and prevalence of SSRF, where application features that accept URLs or incorporate user data into URLs can make server-side requests to unexpected or internal destinations.

## Approach / What changed

It presents Smokescreen as an egress proxy, explains its publicly routed IP checks and ACL actions, and describes a Fly modification that authenticates clients with PROXY\_PASSWORD. It also provides Fly and Docker deployment commands and authenticated Go and Node.js proxy examples.

## Takeaways

- SSRF commonly appears in webhook-style features that accept destination URLs or in features that insert user data into request URLs.
- Smokescreen checks destinations against private IPv4 ranges 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16, along with IPv6 ULA space fc00::/7.
- Its ACL actions distinguish open traffic, report-only logging for out-of-list requests, and enforce mode, which blocks requests not on the allowed list.

**Tags:** [Security](https://yomu.fyi/topic/security), [Smokescreen](https://yomu.fyi/topic/smokescreen), [SSRF](https://yomu.fyi/topic/ssrf)

- Source: [Fly.io](https://fly.io/blog/practical-smokescreen-sanitizing-your-outbound-web-requests)
- Source URL: https://fly.io/blog/practical-smokescreen-sanitizing-your-outbound-web-requests
- Ingested by Yomu: 2026-09-02T12:00:02.174Z

[Read original post](https://fly.io/blog/practical-smokescreen-sanitizing-your-outbound-web-requests)