3 ms·
But note that a simple <img src="http://127.0.0.1:8080"> should do so as well, ie this is just the newest iteration of an old problem that the major brows
by cygx 6y ago
But note that a simple
<img src="http://127.0.0.1:8080">
should do so as well, ie this is just the newest iteration of an old problem that the major browser vendors never chose to properly address - with the exception of Opera, see eg this stackoverflow question [1] and corresponding answer from 2011.
[1] https://stackoverflow.com/questions/5464599 https://stackoverflow.com/questions/5464599
- TekMol 6y agoThe page could never read the contents of the image, right? If the user has a web-socket-server running (for example because he is a developer) could the page read from it? Can a page read from any web socket server on the internet?
- cygx 6y agoIf the user has a web-socket-server running (for example because he is a developer) could the page read from it? Only if that server chooses to accept the request, which it can decide based on the Origin header. Personally, I was more concerned with getting spurious requests on ports bound to 127.0.0.1 (which I've been using for IPC), but that issue already existed before the introduction of WebSockets. WebSockets of course do make things like port scanning easier, but as others have pointed out, you could already do that with a bit of ingenuity eg through tracking response times.