3 ms·

If you've got rogue software running on your machine, all bets are off.

• Ajedi32 8y ago
  Not necessarily. It could be running in a sandbox, or as unprivileged user, and accessing your app's API over localhost would allow for privilege escalation.
  • mholt 8y ago
    I see your point. But in my book, that's still rogue software. And that's a terrible sandbox. :)
    • orf 8y ago
      I see your point, but you're saying: > Yeah, we don't trust just anything that comes in on that socket Well, you are, you're trusting it came from a browser so the Origin header is correct, right?