9 ms·

It is beyond sad that this was upvoted on HACKERnews. This is an intentional feature of web browsers and a specified feature of web standards. Could it use impr

It is beyond sad that this was upvoted on HACKERnews. This is an intentional feature of web browsers and a specified feature of web standards. Could it use improvement? Maybe. Should we disable localhost requests from webpages? Abso-fucking-lutely not. "Is this possibility not surprising to you?" > no "It was surprising to me!" > that is because you don't understand the web "The problem is actually worse than this." > I wouldn't call it a problem "The major browsers I've tested — Safari, Chrome, Firefox — all allow web pages to send requests not only to localhost but also to any IP address on your Local Area Network!" > Yes, that's called conforming to a standard and it took years of work to get them all to behave the same. In other news, the sky is blue, trees are green, and shooting yourself in the foot still makes you bleed.

wool_gather 7y ago
I'm interested in learning more about the use cases and standard for this, because, yes, I don't perfectly understand the web. Can you share your knowledge and point to resources that I can read?
- bendbro 7y ago
  CORS allows websites to specify which resources (other than their "same origin") can access their information. A simple is how jquery allows any website to access jquery scripts from their CDN. CORS also works on the local network, or even localhost, as the author has discovered for himself here. Uses in these spaces are less ubiquitous, but if you have ever needed to set up a web enabled resource in these spaces, you may need CORS. I'll give some theoretical uses here: 1. A company sells routers. They host a webpage at company.com that makes requests to your router at <scary ip> 2. A company sells a big, expensive hardware component that attaches to your computer. To manage this component, they set up a website at company.com, and the component sets up a website on your computer. Company.com makes requests to localhost, to manage that big, expensive component. The actual issue here is that companies setting up these websites at localhost and in your local network do not securely set up CORS (see Zoom, other issues). Although it would be unreasonable to kill these use cases, it would be reasonable to require the user of the browser to check off that a localhost or local network request is okay.

wool_gather 7y ago

I'm interested in learning more about the use cases and standard for this, because, yes, I don't perfectly understand the web. Can you share your knowledge and point to resources that I can read?

bendbro 7y ago
CORS allows websites to specify which resources (other than their "same origin") can access their information. A simple is how jquery allows any website to access jquery scripts from their CDN. CORS also works on the local network, or even localhost, as the author has discovered for himself here. Uses in these spaces are less ubiquitous, but if you have ever needed to set up a web enabled resource in these spaces, you may need CORS. I'll give some theoretical uses here: 1. A company sells routers. They host a webpage at company.com that makes requests to your router at <scary ip> 2. A company sells a big, expensive hardware component that attaches to your computer. To manage this component, they set up a website at company.com, and the component sets up a website on your computer. Company.com makes requests to localhost, to manage that big, expensive component. The actual issue here is that companies setting up these websites at localhost and in your local network do not securely set up CORS (see Zoom, other issues). Although it would be unreasonable to kill these use cases, it would be reasonable to require the user of the browser to check off that a localhost or local network request is okay.