3 ms·
He just needs to happen to have IPFS running. Any website can make a request to localhost via Javascript or even without. Scenario: Attacker sends you harmles
by eis 11y ago
He just needs to happen to have IPFS running. Any website can make a request to localhost via Javascript or even without.
Scenario:
Attacker sends you harmless looking link to a page that contains some invisible JS that sends a request to localhost and pins kiddypon on your IPFS node.
Attacker then sends the police to you.
- ossreality 11y agoum, cross origin blocking has been a thing for... like a really really long time now.
- mappum 11y agoThe IPFS API isn't exposed like that, there is actually a whitelist for hashes that can access the API (the IPFS webui is in the whitelist by default), and hashes that are blocked will get a 403.