3 ms·
Every one of those are solved by CSP/X-Frame-Options headers, CORS headers with content-type (non-normal form content-types) checks and proper handling of HTTP
by SahAssar 7y ago
Every one of those are solved by CSP/X-Frame-Options headers, CORS headers with content-type (non-normal form content-types) checks and proper handling of HTTP Methods. DNS rebinding is solved by https, and if you are doing something sensitive over a network (even a local one) I'm going to assume https is the proper way.
We have ways of handling these things, they just require a bit of reading/implementation and are unfortunately non-default.
- anaphor 7y agoWhich is sort of exactly my point. There is no need to have a blanket ban on any linking between local/non-local sites. You just need to make sure they are set up to handle requests securely.