5 ms·

Super bad news about that: even if it didn't allow the `localhost` string, DNS rebinding allows the domain name of the site you visited to become 127.0.0.1. Th

Super bad news about that: even if it didn't allow the `localhost` string, DNS rebinding allows the domain name of the site you visited to become 127.0.0.1. The answer to why browsers allow connections to 127.0.0.1 from external sites is probably something like "legacy reasons".

edwintorok 6y ago
DNS rebinding can be fixed at the DNS server level. OpenWRT has an option for it. But this websocket thing in browsers can't easily be turned off/mitigated AFAICT.
- bawolff 6y ago
  Well if you are going to use custom software to alter how protocols work, you could just change your web browser.
- gruez 6y ago
  >DNS rebinding can be fixed at the DNS server level You can't always depend on that. eg. when you're on public/enterprise wifi that intercepts DNS requests.
  - Avamander 6y ago
    This is why a local stub is a very good idea.
- inetknght 6y ago
  > DNS rebinding can be fixed at the DNS server level. Let me know how that works with DNS over HTTP
- m00dy 6y ago
  Or you can have this on firewall level.
  - cjbprime 6y ago
    No you can't -- the request from the browser is coming from inside the firewall, on an internal IP.
    - oriettaxx 6y ago
      exactly!
    - m00dy 6y ago
      well, I meant that there are some special firewalls that you can handle dns-rebinding attacks.