3 ms·
Perversely, a well-timed DNS record update and cache expiry could make a URL not-equal to another URL made from the same string of characters.
by edw 7y ago
Perversely, a well-timed DNS record update and cache expiry could make a URL not-equal to another URL made from the same string of characters.
- throwawaymath 7y agoThat's the essence of a DNS rebinding attack, which can be used to bypass server-side request forgery vulnerability mitigations.
- znep 7y agoI might be wrong, it was a long time ago, but IIRC a different DNS rebinding attack was actually part of the reason this behavior was introduced to the URL class, to help protect against such attacks in Java Applets.
- kelnos 7y agoHell, no need for a record update: just multiple A records for the same hostname, with a short enough TTL that two different URL instances could conceivably resolve differently.