4 ms·
Why don't all browsers, desktop and mobile, just block all cross-origin access to localhost?
by josephcsible 1y ago
Why don't all browsers, desktop and mobile, just block all cross-origin access to localhost?
- easterncalculus 1y agoFor one I think it would break all those "update your BIOS via your motherboard website" apps that probably shouldn't exist anyways. There probably are some legitimate uses, but I'm straining to come up with them.
- arunkant 1y agoMaybe just ask for confirmation
- chedabob 1y agoI thought they did for resources and JS, which is why Meta have to use WebRTC instead? I think the Yandex one slips through because CORS does a naive check against just what's in the header, not what it resolves to?
- dwaite 1y agoThere's effort to define standard behavior here. See https://wicg.github.io/private-network-access/ https://wicg.github.io/private-network-access/ (although I suspect this document may make a significant shift soon)