4 ms·
> should not be using .localhost if the target is not running on your loopback interface, resolving localhost to anything but loopback is considered harmful. I
by mikl 9y ago
> should not be using .localhost if the target is not running on your loopback interface, resolving localhost to anything but loopback is considered harmful.
I have heard this before, but not really seen any great arguments as to why. Sure, `localhost` should not be bound to anything other than loopback, but I don’t see the harm in remapping `whatever.localhost` to the IP address of the Vagrant box running on your local machine.
- tscs37 9y agohttps://tools.ietf.org/html/draft-west-let-localhost-be-localhost-04 https://tools.ietf.org/html/draft-west-let-localhost-be-loca... The problem is that while the loopback addresses can be mapped as a secure context, even without HTTPS, .localhost. cannot since it might not be a loopback context. You can literally use anything else to map to your vagrant box including "whatever.i-dont-care" and "whatever.whatever". Remapping .localhost. destroys the implicit assumption of many developers that a .localhost. means loopback and rightfully the above draft proposes to force any resolve to either fail or resolve to loopback.
- mikl 9y agoWhich developers? I’ve never heard of anyone using whatever.localhost in their code, assuming it will map to loopback? Sane developers use localhost, or localhost.localdomain in some cases.
- tscs37 9y agoit's usually not in the code but in testing or dev environments. Makes developing multi-server apps a bit easier since I can point it all to loopback without worry. (Plus using multiple loopback addresses helps)