---
title: "Smokescreen"
description: "1 posts about Smokescreen, summarised, each linking to the original."
---

# Smokescreen
> 1 posts about Smokescreen, summarised, each linking to the original.

## Articles

### [You should know about Server-Side Request Forgery](https://yomu.fyi/post/you-should-know-about-server-side-request-forgery.md)
- Company: [Fly.io](https://yomu.fyi/company/fly-io.md)
- Published: Feb 5, 2021
- Type: Tutorial

Server-side request forgery (SSRF) lets attackers make an application server issue HTTP requests, potentially reaching internal resources behind its security perimeter and taking over the hosting environment. The post describes two common patterns—user-supplied URLs and user data incorporated into URLs—and presents Smokescreen, an egress proxy, as a mitigation. Smokescreen checks that requested IP addresses are publicly routed, blocking private IPv4 ranges and IPv6 ULA space, while ACL actions can open, report, or enforce traffic rules. The Fly modification authenticates clients with a shared PROXY\_PASSWORD, maps authenticated requests to an authed role, and includes deployment instructions for Fly and Docker plus Go and Node.js examples that send authenticated HTTPS requests through the proxy.