4 ms·
This is why, when I've written an app that runs on localhost, I generate a random token to authenticate access to it, then launch a web browser pointing to the
by TazeTSchnitzel 9y ago
This is why, when I've written an app that runs on localhost, I generate a random token to authenticate access to it, then launch a web browser pointing to the localhost URL with that token. It prevents this type of attack entirely, it's sort of like XSRF prevention.
- hellbanner 9y agoThe Parity cli (Parity is a Proof-of-Authority Ethereum testnet) does exactly this: https://github.com/paritytech/parity https://github.com/paritytech/parity
- joshuakelly 9y agoThis is not quite right - Parity is an EVM implementation, and supports the PoW Foundation chain, amongst other configurations like PoA.
- icebraining 9y agoIt's what git-annex does too. In fact, it does a bit more: rather than launching the browser directly to that URL, it generates an HTML file that then redirects the browser to the URL. That prevents other users in the same system from discovering the token by looking at the process arguments.
- tfha 9y agoIsn't it enough just to have the app require a certain user agent?
- always_good 9y agoThat would still be an authentication token, just placed somewhere else in the request.
- mattigames 9y agoYou could to that in the server level (not the app level); e.g. in the .htaccess file for apache users.