3 ms·
> How does HTTP(S) Same Origin policy work with local file:/// URLs? It doesn't since file:/// is just a uri and not part of the http protocol
by awithrow 3y ago
> How does HTTP(S) Same Origin policy work with local file:/// URLs?
It doesn't since file:/// is just a uri and not part of the http protocol
- westurner 3y agoIf I open an HTML copy of a manpage that contains JS from a file:/// URL, can it read other local files and send them to another server with img URLs? If so, Isn't it thus probably better to run an HTTP server over a permissioned socket than to serve static HTML [manpages] from file URLs [in a [DEB] package]?
- awithrow 3y agofile:/// is always going to be local to the machine reading the URI. So if you're serving a page that has a file:/// uri in it and someone on another machine clicks on it, they wont be seeing the file (unless they happen to have the same path on their machine). If the goal is get them that file, then yes, it'll need to be served.
- westurner 3y agoCVE-2019-11730: https://nvd.nist.gov/vuln/detail/CVE-2019-11730 https://nvd.nist.gov/vuln/detail/CVE-2019-11730
- jwilk 3y agohttps://developer.mozilla.org/en-US/docs/Web/Security/Same-origin_policy#file_origins https://developer.mozilla.org/en-US/docs/Web/Security/Same-o...