smokescreen

Also from Stripe team (used in past, and believe still running without issues to this day) https://github.com/stripe/smokescreen Smokescreen is a HTTP CONNECT proxy. It proxies most traffic from Stripe to the external world (e.g., webhooks). Smokescreen restricts which URLs it connects to: It uses a pre-configured hostname ACL to only allow requests addressed to certain allow-listed hostnames, to ensure that no malicious code is attempting to make requests to unexpected services. It also resolves each domain name that is requested, and ensures that it is a publicly routable IP address and not an internal IP address. This prevents a class of attacks where, for instance, our own webhooks infrastructure is used to scan Stripe’s internal network. Smokescreen can also be further configured to allow or deny specific IP addresses or ranges.

I often need to make a HTTP request to a user supplied URL, but I then need to protect myself from SSRF attacks, such as users supplying URL's to "localhost:3000/protected-thing" etc. SSRF Proxy is hopefully the simplest and quickest way to get protection. Currently there is just a Node SDK but I will generate other languages soon. It is built on Elixir/Phoenix with live view and uses https://github.com/stripe/smokescreen and nextdns in the background.

Stripe built an OSS egress network proxy that prevents webhooks from reaching internal resources: https://github.com/stripe/smokescreen

Smokescreen by Stripe [1] is the only reliable way I’ve seen apps handle untrusted URL accesses. It’s an open source CONNECT proxy project. Validating the URL at the app layer is difficult because a redirect could happen to an attacker URL, or DNS rebinding attack, etc, proxying via Smokescreen seems the most reliable if you’re dealing with user controlled arbitrary URLs. [1] https://github.com/stripe/smokescreen

Yeah, well, not only HTTP*, but actually whitelisting whatever outgoing connection you may need. https://github.com/stripe/smokescreen Suppose you configured your webserver to run with limited privileges so as if someone hacks it it has limited access. Suppose it still has access to DB and stuff. Well, filtering outgoing connections makes harder to exfiltrate the data OR hop to another hosts. And then you can monitor failed outgoing requests to be able to act/investigate when that happens.

> "https://github.com/stripe/smokescreen" I don't understand why they built this. The problem described here is solved by using a firewall, where certain machines/processes are either allowed or disallowed to communicate with other machines/processes based on a set of rules. What else is there to it?

New to the list is Server-Side Request Forgery (SSRF), where you trick the remote server to fetch a sensitive URL on an attackers behalf (eg, internal service or cloud metadata URL from the context of an internal server), a language-agnostic defense is using something like Stripe's Smokescreen [1] which acts as a SOCKS proxy your app connects to when requesting URLs that should be quarantine'd, and it does the enforcement of access to internal/external IPs or not. [1] https://github.com/stripe/smokescreen