81–90 of 198 posts
Here's a question I've had for a while: WHY in the world do web browsers not block access to localhost? What exactly is the extremely compelling use case that has prevented them from blocking this?
Here's a question I've had for a while: WHY in the world do web browsers not block access to localhost? What exactly is the extremely compelling use case that has prevented them from blocking this?
What would be a better, more secure thing to do when you have multiple web servers on one machine behind a SSL-terminating reverse proxy?
Here's a question I've had for a while: WHY in the world do web browsers not block access to localhost? What exactly is the extremely compelling use case that has prevented them from blocking this?
There are a fair number of applications that expose a UI with a local web server. I use the Ubiquiti Controller, but it's also quite common in the world of Plex, etc. It's also a path used for local OIDC, such as with the gcloud CLI.
I'm not talking about UIs hosted on local web servers being able to send requests to themselves, I'm talking about UIs hosted on REMOTE web servers being able to send requests to local ones. It seems far worse than a random cross-origin request to me and for the life of me I can't imagine uses cases.
Can anyone share what measures we can take as web developers to secure local development environment?
Custom DNS server with DNS rebind protection. E.g. if you’re running OpenWRT you’re fine[1]. Also just don’t test on localhost. You can use a proper domain (or claim one in .test TLD[1] if you’re fine with selfsigned certs) and point it to localhost. If you’re going to use any redirect flow like OAuth/OpenID you’re going to need this for testing eventually anyway. [1] https://openwrt.org/docs/guide-user/base-system/d…
Think self hosted Wiki/etc. I was never sure (and thusly have yet to properly implement it) what would be secure, but also a good UX. A normal auth + self signed https would be simplest I imagine, but I'm not clear if browsers widely accept that. I recall Sandstorm having issues with this area, and required a domain to fully run properly. Which seems.. complex for a minimal install requirement.
Thoughts?
Other approach is to create a useful extension like: https://addons.mozilla.org/en-US/firefox/addon/yt-adblock/reviews/ disguise that you're inserting an iframe linking to your web server into every single page user opens, by naming variables and your tracking domain incorrectly and by waiting for an hour after installation (this may also help avoid automatic tests mozilla is doing) and then just sit back and wait an…
> It is not sufficient security to only bind to 127.0.0.1 (the “loopback interface”) What would be a better, more secure thing to do when you have multiple web servers on one machine behind a SSL-terminating reverse proxy?
Any person that joins the wifi network and goes to a website that sniff's this out will have access to my computers local server?
It looks like a mistake because the image URLs are unlikely to exist on YOUR localhost at port 4000 when you load the page.
I only ever run my local dev server on port 80, and use a hosts file to assign custom (fake) domain names to each of the sites I want to run. I mentioned as much here a few years ago when I first came across this idea of assigning (and remembering) random unique port numbers to every one of your apps in development, and was surprised to hear that it's such a common practice. It seems sub-optimal for a lot of reasons,…
Unless I'm missing something, this only works if you are running one site at a time, or you have a single web server bound to port 80 that supports virtual hosts. You also need application and/or configuration support to get this working properly. And even then, if you run any software with an embedded web server you are usually out of luck unless you want to fiddle with a reverse proxy configuration. For these reaso…