3 ms·
Works on localhost. It is not a big deal.
by nurettin 3y ago
Works on localhost. It is not a big deal.
- rekoil 3y agoIf you're hosting your applications on localhost it can be a security risk. A blind SSRF vulnerability (with payload control) in your application could be used to gain full control over the reverse proxy resulting in the attacker gaining full unfettered access to your network. If you're not using it (and you shouldn't be using such functionality on a production machine), then you don't need it and should disable it, see: https://owasp.org/Top10/A05_2021-Security_Misconfiguration/ https://owasp.org/Top10/A05_2021-Security_Misconfiguration/
- rocqua 3y agoIf your server reaches out to user-provided URLs, it can be a big deal. Especially with DNS rebinding, remote users can bind domains to 127.0.0.1. Which avoids cors like protections.
- mholt 3y agoWe mitigate both DNS rebinding and cross-origin in the admin endpoint by verifying Host and Origin headers -- by default.
- deleted 3y ago[deleted]
- mrd3v0 3y agoThis is how trivial bugs turn into full-fledged threats. Increasing attack surfaces without any justification is bad cyber security.
- Gud 3y agoIt is absolutely a big deal. Any server software should be secure by default, period.