> so that range can be default exempted I disagree. I know it’s done, but I don’t think that makes it safe or smart. Require the user to OK it and require the

> so that range can be default exempted I disagree. I know it’s done, but I don’t think that makes it safe or smart. Require the user to OK it and require the server to send a header with the one _exact_ port it will access. Require that the local server _must_ use CORS and allow that server. No website not loaded from localhost should ever be allowed to just hit random local/private IPs and ports without explicit permission.