3 ms·
I mentioned this above, but we plan to let the localhost/private page support an explicit opt-in, maybe via CORS headers. Those details may not be captured in t
by justinschuh 12y ago
I mentioned this above, but we plan to let the localhost/private page support an explicit opt-in, maybe via CORS headers. Those details may not be captured in the bugs yet because currently no one is actively working on this.
- jorangreef 12y agoWebsockets already have the Origin header as mentioned in the bug by Tyoshino: https://code.google.com/p/chromium/issues/detail?id=378566#c5 https://code.google.com/p/chromium/issues/detail?id=378566#c... Edit: From my other comments, there is the additional implicit opt-in shown by WSS itself on localhost requiring (1) a public DNS record and (2) a valid SSL certificate for that FQDN. I doubt that there are WSS servers on localhost out there setup with a public DNS record and validating SSL certificate which are not also expecting public traffic.
- justinschuh 12y agoAs I explained in my other comment, the origin header in websockets doesn't help in addressing the attacks we see, because it is a server-side measure.