2 ms·
If your server reaches out to user-provided URLs, it can be a big deal. Especially with DNS rebinding, remote users can bind domains to 127.0.0.1. Which avoids
by rocqua 3y ago
If your server reaches out to user-provided URLs, it can be a big deal. Especially with DNS rebinding, remote users can bind domains to 127.0.0.1. Which avoids cors like protections.
- mholt 3y agoWe mitigate both DNS rebinding and cross-origin in the admin endpoint by verifying Host and Origin headers -- by default.
- deleted 3y ago[deleted]