3 ms·
You can probably just use access-control-allow-origin: * to "turn off" CORS on the local server. Since you are behind the reverse proxy anyway, there is probab
by mattlondon 3y ago
You can probably just use access-control-allow-origin: * to "turn off" CORS on the local server.
Since you are behind the reverse proxy anyway, there is probably not much of a security implication?
- paulgb 3y ago> Since you are behind the reverse proxy anyway, there is probably not much of a security implication? If you access other sites in the same browser, they'll be able to send requests to your private localhost server. I don't expect this to be a problem right now, but if it becomes a popular thing to do that might change.
- westurner 3y agoWith such configuration, requests to e.g. a jupyterlab/cockpit/mosh webterm on localhost - if the auth token is already stored in a cookie - thus can execute arbitrary commands as the user running an rshell on localhost.