4 ms·
Yes, but aren't HTTP requests subject to CORS? I'm pretty sure, otherwise, that is a gaping hole in many security setups right now - if any website could poke
by zeusk 7y ago
Yes, but aren't HTTP requests subject to CORS?
I'm pretty sure, otherwise, that is a gaping hole in many security setups right now - if any website could poke local sockets using client JS.
- tsimionescu 7y agoCORS applies only to JS code - sites can still issue cross-origin GETs and POSTs via HTML, using Forms for example. Not sure whether there is enough control on the format to actually issue a valid Docker request. Still, it's generally a pretty bad idea to have an unauthenticated service running on localhost which can perform arbitrary operations on the system - you're depending on all other software running on the system not to transform that into a vulnerability.