4 ms·

Here's a question I've had for a while: WHY in the world do web browsers not block access to localhost? What exactly is the extremely compelling use case that h

Here's a question I've had for a while: WHY in the world do web browsers not block access to localhost? What exactly is the extremely compelling use case that has prevented them from blocking this?

rahuldottech 7y ago
Some browsers apparently do, which is why this demo isn't working for some HN users.
kmlx 7y ago
quick development? some of us use localhost to quickly test/develop.
jarofgreen 7y ago
Or it could be like what happens if you access a site with a broken SSL cert - you get a big red warning page and your only allowed to continue after clicking some tiny technical option.
mjlee 7y ago
There are a fair number of applications that expose a UI with a local web server. I use the Ubiquiti Controller, but it's also quite common in the world of Plex, etc. It's also a path used for local OIDC, such as with the gcloud CLI.
- mehrdadn 7y ago
  > expose a UI with a local web server I'm not talking about UIs hosted on local web servers being able to send requests to themselves, I'm talking about UIs hosted on REMOTE web servers being able to send requests to local ones. It seems far worse than a random cross-origin request to me and for the life of me I can't imagine uses cases.
  - penagwin 7y ago
    While I think it would be a shame to completely disable the ability for remote sites to access localhost (I'm sure it can be useful somehow), it would make far more sense to be opt-in for those cases. Maybe browsers should assume a CORS deny all unless otherwise specified?
  - linuxftw 7y ago
    That's not really how the internet works. What is a local webserver? Running on your machine? Running on your LAN? Running on your corporate intranet? How should a browser differentiate between these things? What qualifies as a remote server? Did you know, some very large enterprise environments squat on public IP's for private intranet internally due to address space exhaustion (IPv4 anyway)? Just because something appears to be on a public address doesn't mean it actually is.
    - boomlinde 7y ago
      It seems like an obvious measure would be for sites served outside the private-use or loopback ranges to be unable to request content from servers in private-use or loopback ranges. > Did you know, some very large enterprise environments squat on public IP's for private intranet internally due to address space exhaustion (IPv4 anyway)? Sucks to be them. If they've exhausted their private use IPv4 addresses, they can either rest comfortably knowing that NAT and IPv6 can solve their problem or they can ignore IETF recommendations and build a card house network that breaks if you give it a stern look.
      - linuxftw 7y ago
        My preferred solution would be to disable javascript altogether. > Sucks to be them. If they've exhausted their private use IPv4 addresses, they can either rest comfortably knowing that NAT and IPv6 can solve their problem or they can ignore IETF recommendations and build a card house network that breaks if you give it a stern look. This will only lead to organizations running IE7 (or whatever outdated IE version is most common now) forever.
        boomlinde 7y ago
        > My preferred solution would be to disable javascript altogether. My preferred solution would be not to use web browsers at all, but our preferred solutions are much harder to make a case for than a simple security policy. > This will only lead to organizations running IE7 (or whatever outdated IE version is most common now) forever. In general, let's let them make that choice, but this could be configurable in the browser in the same way Javascript and cookie policy exceptions are handled.
jahewson 7y ago
They do... [Error] Failed to load resource: Origin http://http.jameshfisher.com http://http.jameshfisher.com is not allowed by Access-Control-Allow-Origin. (localhost, line 0)
efreak 7y ago
Caching reverse proxies for local virtual machine use, in my case. Primarily used for Linux repos, but also configured for personal use, eg for webcomics.
- mehrdadn 7y ago
  That's about as far from compelling a reason as you can imagine for the browser to allow this by default?

Here's a question I've had for a while: WHY in the world do web browsers not block access to localhost? What exactly is the extremely compelling use case that has prevented them from blocking this?

rahuldottech 7y ago

Some browsers apparently do, which is why this demo isn't working for some HN users.

kmlx 7y ago

quick development? some of us use localhost to quickly test/develop.

jarofgreen 7y ago

Or it could be like what happens if you access a site with a broken SSL cert - you get a big red warning page and your only allowed to continue after clicking some tiny technical option.

mjlee 7y ago

There are a fair number of applications that expose a UI with a local web server. I use the Ubiquiti Controller, but it's also quite common in the world of Plex, etc. It's also a path used for local OIDC, such as with the gcloud CLI.

mehrdadn 7y ago
> expose a UI with a local web server I'm not talking about UIs hosted on local web servers being able to send requests to themselves, I'm talking about UIs hosted on REMOTE web servers being able to send requests to local ones. It seems far worse than a random cross-origin request to me and for the life of me I can't imagine uses cases.
- penagwin 7y ago
  While I think it would be a shame to completely disable the ability for remote sites to access localhost (I'm sure it can be useful somehow), it would make far more sense to be opt-in for those cases. Maybe browsers should assume a CORS deny all unless otherwise specified?
- linuxftw 7y ago
  That's not really how the internet works. What is a local webserver? Running on your machine? Running on your LAN? Running on your corporate intranet? How should a browser differentiate between these things? What qualifies as a remote server? Did you know, some very large enterprise environments squat on public IP's for private intranet internally due to address space exhaustion (IPv4 anyway)? Just because something appears to be on a public address doesn't mean it actually is.
  - boomlinde 7y ago
    It seems like an obvious measure would be for sites served outside the private-use or loopback ranges to be unable to request content from servers in private-use or loopback ranges. > Did you know, some very large enterprise environments squat on public IP's for private intranet internally due to address space exhaustion (IPv4 anyway)? Sucks to be them. If they've exhausted their private use IPv4 addresses, they can either rest comfortably knowing that NAT and IPv6 can solve their problem or they can ignore IETF recommendations and build a card house network that breaks if you give it a stern look.
    - linuxftw 7y ago
      My preferred solution would be to disable javascript altogether. > Sucks to be them. If they've exhausted their private use IPv4 addresses, they can either rest comfortably knowing that NAT and IPv6 can solve their problem or they can ignore IETF recommendations and build a card house network that breaks if you give it a stern look. This will only lead to organizations running IE7 (or whatever outdated IE version is most common now) forever.
      - boomlinde 7y ago
        > My preferred solution would be to disable javascript altogether. My preferred solution would be not to use web browsers at all, but our preferred solutions are much harder to make a case for than a simple security policy. > This will only lead to organizations running IE7 (or whatever outdated IE version is most common now) forever. In general, let's let them make that choice, but this could be configurable in the browser in the same way Javascript and cookie policy exceptions are handled.

jahewson 7y ago

They do... [Error] Failed to load resource: Origin http://http.jameshfisher.com http://http.jameshfisher.com is not allowed by Access-Control-Allow-Origin. (localhost, line 0)

efreak 7y ago

Caching reverse proxies for local virtual machine use, in my case. Primarily used for Linux repos, but also configured for personal use, eg for webcomics.

mehrdadn 7y ago
That's about as far from compelling a reason as you can imagine for the browser to allow this by default?