3 ms·

Pretty much all modern browsers allow access to localhost, even from TLS pages. They treat localhost as though it were TLS so it's not even demoted to "mixed co

Pretty much all modern browsers allow access to localhost, even from TLS pages. They treat localhost as though it were TLS so it's not even demoted to "mixed content". And beyond that they also allow mixed content for asset requests from TLS pages to non-TLS URLs of any IP address (for instance an AT&T modem configuration page at 192.168.1.254). This site detects all kinds of services running on your local network: https://github.com/wybiral/localtoast https://github.com/wybiral/localtoast I wrote a more in-depth explanation of this behavior here: https://davywybiral.blogspot.com/2019/05/always-secure-your-localhost-servers.html https://davywybiral.blogspot.com/2019/05/always-secure-your-...

uxp 7y ago
> [Warning] [blocked] The page at https://wybiral.github.io/localtoast/ https://wybiral.github.io/localtoast/ was not allowed to display insecure content from http://127.0.0.1/ http://127.0.0.1/. (index.js, line 172) You sure about your claims? Your own website exhibits a countering argument.
- to11mtm 7y ago
  Some items show up as blocked for me, But it was able to successfully ping my running Steam Client. The page works like an acid test; if it's clean, you're clean. If it finds something, it says what and the port.
  - wybiral 7y ago
    Real fun times is the fact that -on Linux machines- something like this will cause Steam to freeze and even crash certain games just by visiting the page: https://wybiral.github.io/steam-block/ https://wybiral.github.io/steam-block/ Doesn't seem to affect Windows version though.
- wybiral 7y ago
  On what browser? Works fine with Chrome and Firefox for me. It also works in Brave Browser even when in "Tor mode" (which seems very wrong).
- bradyd 7y ago
  That page worked in Firefox, Chrome, and Edge for me with only warnings in the console. Chrome v75.0.3770.100: "Mixed Content: The page at 'https://wybiral.github.io/localtoast/' https://wybiral.github.io/localtoast/' was loaded over HTTPS, but requested an insecure image 'http://192.168.1.254/images/att_globe_logo.png' http://192.168.1.254/images/att_globe_logo.png'. This content should also be served over HTTPS." Firefox v69.0b4: "Loading mixed (insecure) display content “http://fritz.box/css/rd/images/fritzLogo.svg” http://fritz.box/css/rd/images/fritzLogo.svg” on a secure page" Edge v44.18362.1.0: "SEC7137: [Mixed-Content] The origin 'https://wybiral.github.io' https://wybiral.github.io' was loaded in a secure context and loaded an optionally blockable insecure image resource at 'http://fritz.box/css/rd/images/fritzLogo.svg'." http://fritz.box/css/rd/images/fritzLogo.svg'."
  - wybiral 7y ago
    The image requests only work because of mixed-content where browsers allow a TLS page to include non-TLS assets. Those are ones outside of localhost. For localhost-only you don't get those warnings because browsers treat localhost as TLS even if it's not, such as this: https://github.com/wybiral/wtf https://github.com/wybiral/wtf

uxp 7y ago

> [Warning] [blocked] The page at https://wybiral.github.io/localtoast/ https://wybiral.github.io/localtoast/ was not allowed to display insecure content from http://127.0.0.1/ http://127.0.0.1/. (index.js, line 172) You sure about your claims? Your own website exhibits a countering argument.

to11mtm 7y ago
Some items show up as blocked for me, But it was able to successfully ping my running Steam Client. The page works like an acid test; if it's clean, you're clean. If it finds something, it says what and the port.
- wybiral 7y ago
  Real fun times is the fact that -on Linux machines- something like this will cause Steam to freeze and even crash certain games just by visiting the page: https://wybiral.github.io/steam-block/ https://wybiral.github.io/steam-block/ Doesn't seem to affect Windows version though.
wybiral 7y ago
On what browser? Works fine with Chrome and Firefox for me. It also works in Brave Browser even when in "Tor mode" (which seems very wrong).
bradyd 7y ago
That page worked in Firefox, Chrome, and Edge for me with only warnings in the console. Chrome v75.0.3770.100: "Mixed Content: The page at 'https://wybiral.github.io/localtoast/' https://wybiral.github.io/localtoast/' was loaded over HTTPS, but requested an insecure image 'http://192.168.1.254/images/att_globe_logo.png' http://192.168.1.254/images/att_globe_logo.png'. This content should also be served over HTTPS." Firefox v69.0b4: "Loading mixed (insecure) display content “http://fritz.box/css/rd/images/fritzLogo.svg” http://fritz.box/css/rd/images/fritzLogo.svg” on a secure page" Edge v44.18362.1.0: "SEC7137: [Mixed-Content] The origin 'https://wybiral.github.io' https://wybiral.github.io' was loaded in a secure context and loaded an optionally blockable insecure image resource at 'http://fritz.box/css/rd/images/fritzLogo.svg'." http://fritz.box/css/rd/images/fritzLogo.svg'."
- wybiral 7y ago
  The image requests only work because of mixed-content where browsers allow a TLS page to include non-TLS assets. Those are ones outside of localhost. For localhost-only you don't get those warnings because browsers treat localhost as TLS even if it's not, such as this: https://github.com/wybiral/wtf https://github.com/wybiral/wtf