3 ms·
Node debug mode runs a websocket, but the address is something like ws://0.0.0.0:9229/1cda98c5-9ae8-4f9a-805a-f36d0a8cdbe8 - without the correct guid at the end
by ff7c11 6y ago
Node debug mode runs a websocket, but the address is something like ws://0.0.0.0:9229/1cda98c5-9ae8-4f9a-805a-f36d0a8cdbe8 - without the correct guid at the end, you can't open the websocket and communicate. You can only detect the port being open by timing.
- taviso 6y agoThis is true, although until recently it was possible to use DNS rebinding to get the list of guids! I actually saw people leaving this enabled so much in shipping products, I wrote a little utility to test for it. https://github.com/taviso/cefdebug https://github.com/taviso/cefdebug
- ff7c11 6y agoThanks that's really interesting, as I see from your reports you could call /json/list with rebinding to get the guid. For the past 2 years it now validates the Host header.