3 ms·

It does mention private to local requests will be affected, which is implying the private network host must be served via https > Requests from a private netwo

• duskwuff 6y ago
  "Local", in this context, means localhost (i.e. the machine that the web browser is running on). It does not mean other machines on the private network. Generally speaking, this simply enforces that, if you are running a web server on your local machine, external web sites (either on your private network or on the Internet at large) cannot trigger requests to that web server.
  • xg15 6y ago
    Yes, but that would mean that a web page served from 192.168.1.1 wouldn't be able to talk with a deamon on localhost if I understand that correctly - unless the private site speaks https, has a domain on the public DNS with a valid cert, etc etc.
    • duskwuff 6y ago
      Correct. But that's a really weird use case, and one which deserves some attention to security. The local network can contain untrusted devices (or devices which can be subverted into behaving in untrustworthy ways), after all; it's no more appropriate to allow one of them to access a daemon running on localhost than it would be to allow an arbitrary web site to do so.
      • xg15 6y ago
        I still have to consciously open the devices' web page in my browser. Why is it fine for a random web page served from the other side of the world to make that connection but not for a web page served from a device sitting next to me?