3 ms·
I'm pretty sure you can make http POST and GET requests from client side JS, and again IIRC you can start a container in Docker with a single POST - no return i
by DuskStar 8y ago
I'm pretty sure you can make http POST and GET requests from client side JS, and again IIRC you can start a container in Docker with a single POST - no return info required
- zeusk 8y agoYes, but aren't HTTP requests subject to CORS? I'm pretty sure, otherwise, that is a gaping hole in many security setups right now - if any website could poke local sockets using client JS.
- tsimionescu 8y agoCORS applies only to JS code - sites can still issue cross-origin GETs and POSTs via HTML, using Forms for example. Not sure whether there is enough control on the format to actually issue a valid Docker request. Still, it's generally a pretty bad idea to have an unauthenticated service running on localhost which can perform arbitrary operations on the system - you're depending on all other software running on the system not to transform that into a vulnerability.