3 ms·
I don't understand why DNS rebinding isn't being fixed by browser vendors. If I make an application that listens only on localhost I shouldn't have to take spec
by r1ch 9y ago
I don't understand why DNS rebinding isn't being fixed by browser vendors. If I make an application that listens only on localhost I shouldn't have to take special steps to ensure random 3rd party remote hosts don't have access to it. The browser's DNS client could see if any recently accessed public IP now resolves to a private IP range and force a fresh CORS check.
- manwithaplan 9y agoFrom the previous discussion linked above: https://news.ycombinator.com/item?id=16563135 https://news.ycombinator.com/item?id=16563135 > I regularly encounter users who don’t accept that websites can access services on localhost or their intranet. These users understand that services bound to localhost are only accessible to software running on the local machine, and that their browser is running on the local machine – but somehow believe that accessing a website “transfers” execution somewhere else. It doesn’t work like that, but this is a common source of confusion.