SSRF Guard & Webhook Forwarding Hardening
When Blacksmith operates in Mode A (Inline Forwarding Proxy), it inspects, validates, and forwards payloads to external automation endpoints. To prevent Server-Side Request Forgery (SSRF):
Inbound and outbound connections require TLS 1.3/1.2. Unencrypted HTTP target URLs are strictly rejected.
Pre-connection DNS resolution blocks RFC1918 subnets, loopback addresses (127.0.0.1), and cloud instance metadata services (169.254.169.254).
Dual-Key Architecture (Decoupled Ingress vs Management)
Blacksmith completely decouples ingress tokens from administrative access keys:
- Write-Only Ingress Tokens (
/v1/in/:token): Unique 32-character tokens scoped to a single endpoint. Even if exposed in an upstream system, they cannot be used to read events or access the dashboard. - Management Bearer Keys: Displayed once upon generation and stored solely as irreversible SHA-256 hashes in our database. Query string authentication (
?key=) is deprecated to prevent credential capture in proxy access logs.
Encryption at Rest & 72-Hour Hard TTL
Quarantined failure events in the Dead-Letter Vault are encrypted with AES-GCM-256 before write. By default, records self-destruct after 72 hours via automated database triggers to ensure temporary forensic storage without long-term data liability.
Need a Data Processing Agreement (DPA)?
We provide standard agency DPAs including Standard Contractual Clauses (SCCs).