3 ms·
Sure, the web server SHOULD... but what if it is misconfigured? Or doesn't have an option to properly validate the Host header? This is an internal client usin
by X-Istence 8y ago
Sure, the web server SHOULD... but what if it is misconfigured? Or doesn't have an option to properly validate the Host header?
This is an internal client using an internal IP address to communicate with an internal service... just so happens that a malicious user made the internal client talk to it maliciously.
DNS rebinding attacks being stopped by the resolver are a great place to start and something we can do. Bypassing that protection in the name of resolving using DoH just means you've made things less secure.
- megous 8y agoI agree. I think DoH should be put on the edge of the network, using something like dnscrypt-proxy. I don't think it should be put in the browser. It would actually made my setup less private, since I use DoH over tor. Though configuring the http servers (like printers or whatever) and/or putting them behind a proxy on a sparate network, if they are sensitive/not configurable, should be done too.