4 ms·
Interesting idea, but a huge security nightmare. Essentially you're opening the door for anyone to send and receive arbitrary ZeroMQ messages to any address via
by a-priori 15y ago
Interesting idea, but a huge security nightmare. Essentially you're opening the door for anyone to send and receive arbitrary ZeroMQ messages to any address via your server, bypassing any outward-facing firewall that might be in place.
One way to make this a bit less of a nightmare is to give the addresses via a server name, and have the proxy map that to an address. That way, the Javascript code can only access specific services known by the proxy.
- hogu 15y agoyes, agreed, I provide 2 functions, one which you override to determine whether a given websocket can connect, and one where you determine whether a given fake zmq socket can connect. you should definitely override both and set them to something sane a list of allowed connection sockets, etc... I might end up making a list of allowed sockets required in the future, or go with your approach of requiring some mapping of strings -> sockets, so chatservice -> tcp://127.0.0.1:9001 for example and then teh client must reference chatservice, rather than tcp://127.0.0.1:9001