4 ms·
The browser is allowing remote code to talk with 127.0.0.1
by thwaysec 1y ago
The browser is allowing remote code to talk with 127.0.0.1
- shakna 1y agoRight... And that's only blocked in the host asks for it via CORS, or Same-Origin policies. Because otherwise you break any combination of apps. It's up to the server on the localhost not to blindly trust. And has been since the beginning.
- thwaysec 1y agoMight have been there since the beginning, but doesn't make it less surprising or bad. That's a _ridiculously_ bad thing to allow. Any website to talk with just about ANY port on your local machine. Incredible.