5 ms·

Why the actual fuck will a browser allow traffic to localhost from anywhere else?

cjbprime 6y ago
Super bad news about that: even if it didn't allow the `localhost` string, DNS rebinding allows the domain name of the site you visited to become 127.0.0.1. The answer to why browsers allow connections to 127.0.0.1 from external sites is probably something like "legacy reasons".
- edwintorok 6y ago
  DNS rebinding can be fixed at the DNS server level. OpenWRT has an option for it. But this websocket thing in browsers can't easily be turned off/mitigated AFAICT.
  - bawolff 6y ago
    Well if you are going to use custom software to alter how protocols work, you could just change your web browser.
  - gruez 6y ago
    >DNS rebinding can be fixed at the DNS server level You can't always depend on that. eg. when you're on public/enterprise wifi that intercepts DNS requests.
    - Avamander 6y ago
      This is why a local stub is a very good idea.
  - inetknght 6y ago
    > DNS rebinding can be fixed at the DNS server level. Let me know how that works with DNS over HTTP
  - m00dy 6y ago
    Or you can have this on firewall level.
    - cjbprime 6y ago
      No you can't -- the request from the browser is coming from inside the firewall, on an internal IP.
      - oriettaxx 6y ago
        exactly!
      - m00dy 6y ago
        well, I meant that there are some special firewalls that you can handle dns-rebinding attacks.
toomim 6y ago
Because the web is supposed to be a web of multiple sites, built my multiple people, sharing a web of resources. Localhost is just another site. If you want to make it secure, make it secure. You realize that anybody on your coffeeshop wifi can also connect to your localhost server, don't you? Just because a server is running on your laptop doesn't mean it's not a server, running on the internet.
- fiter 6y ago
  If you have bound the server to localhost and not all interfaces, then no, people on your coffeeshop wifi cannot connect.
- true_religion 6y ago
  It would be better to say that your laptop is running software on the intranet, not the internet. Also at least by convention, localhost is only accessible via the loopback interface. This allows it to be accessible even if there is no physical network to connect to, but also means that it is only accessible on the same physical/virtual computer that it is running. To let other people in the coffee shop access your software you would need to connect to a public or private interface.
jasonkester 6y ago
A better question is why developers, the only group of people likely to understand this security issue, continue to run things on localhost? Custom hostnames are such a better solution, but for some reason developers don't use them.
- fit2rule 6y ago
  In many projects I have worked on in the last 2 decades, one of the first things I find myself needing to do is fix the name services and setup of .local/.home .. To me it really appears that the skill of naming things starts at the the network - to that end, crap-named networks propagate amnesia.

Super bad news about that: even if it didn't allow the `localhost` string, DNS rebinding allows the domain name of the site you visited to become 127.0.0.1. The answer to why browsers allow connections to 127.0.0.1 from external sites is probably something like "legacy reasons".

edwintorok 6y ago
DNS rebinding can be fixed at the DNS server level. OpenWRT has an option for it. But this websocket thing in browsers can't easily be turned off/mitigated AFAICT.
- bawolff 6y ago
  Well if you are going to use custom software to alter how protocols work, you could just change your web browser.
- gruez 6y ago
  >DNS rebinding can be fixed at the DNS server level You can't always depend on that. eg. when you're on public/enterprise wifi that intercepts DNS requests.
  - Avamander 6y ago
    This is why a local stub is a very good idea.
- inetknght 6y ago
  > DNS rebinding can be fixed at the DNS server level. Let me know how that works with DNS over HTTP
- m00dy 6y ago
  Or you can have this on firewall level.
  - cjbprime 6y ago
    No you can't -- the request from the browser is coming from inside the firewall, on an internal IP.
    - oriettaxx 6y ago
      exactly!
    - m00dy 6y ago
      well, I meant that there are some special firewalls that you can handle dns-rebinding attacks.

toomim 6y ago

Because the web is supposed to be a web of multiple sites, built my multiple people, sharing a web of resources. Localhost is just another site. If you want to make it secure, make it secure. You realize that anybody on your coffeeshop wifi can also connect to your localhost server, don't you? Just because a server is running on your laptop doesn't mean it's not a server, running on the internet.

fiter 6y ago
If you have bound the server to localhost and not all interfaces, then no, people on your coffeeshop wifi cannot connect.
true_religion 6y ago
It would be better to say that your laptop is running software on the intranet, not the internet. Also at least by convention, localhost is only accessible via the loopback interface. This allows it to be accessible even if there is no physical network to connect to, but also means that it is only accessible on the same physical/virtual computer that it is running. To let other people in the coffee shop access your software you would need to connect to a public or private interface.

jasonkester 6y ago

A better question is why developers, the only group of people likely to understand this security issue, continue to run things on localhost? Custom hostnames are such a better solution, but for some reason developers don't use them.

fit2rule 6y ago
In many projects I have worked on in the last 2 decades, one of the first things I find myself needing to do is fix the name services and setup of .local/.home .. To me it really appears that the skill of naming things starts at the the network - to that end, crap-named networks propagate amnesia.