Topic

SSRF

1 post about SSRF. Every summary links to the original.

Paid picks we use ourselves. Links carry a referral code — a subscription through one earns us a commission at no extra cost to you.

Newest first

Posts

Fly.io
You should know about Server-Side Request Forgery
Server-side request forgery (SSRF) lets attackers make an application server issue HTTP requests, potentially reaching internal resources behind its security perimeter and taking over the hosting environment. The post describes two common patterns—user-supplied URLs and user data incorporated into URLs—and presents Smokescreen, an egress proxy, as a mitigation. Smokescreen checks that requested IP addresses are publicly routed, blocking private IPv4 ranges and IPv6 ULA space, while ACL actions can open, report, or enforce traffic rules. The Fly modification authenticates clients with a shared PROXY_PASSWORD, maps authenticated requests to an authed role, and includes deployment instructions for Fly and Docker plus Go and Node.js examples that send authenticated HTTPS requests through the proxy.

The best engineering reads, once a week.

Topic

1 post about SSRF. Every summary links to the original.

Paid picks we use ourselves. Links carry a referral code — a subscription through one earns us a commission at no extra cost to you.

Newest first

Fly.io
You should know about Server-Side Request Forgery
Server-side request forgery (SSRF) lets attackers make an application server issue HTTP requests, potentially reaching internal resources behind its security perimeter and taking over the hosting environment. The post describes two common patterns—user-supplied URLs and user data incorporated into URLs—and presents Smokescreen, an egress proxy, as a mitigation. Smokescreen checks that requested IP addresses are publicly routed, blocking private IPv4 ranges and IPv6 ULA space, while ACL actions can open, report, or enforce traffic rules. The Fly modification authenticates clients with a shared PROXY_PASSWORD, maps authenticated requests to an authed role, and includes deployment instructions for Fly and Docker plus Go and Node.js examples that send authenticated HTTPS requests through the proxy.

The best engineering reads, once a week.