151–160 of 198 posts
Earlier quoted context omitted.
Yup, excited for the meeting. Haven't seen those guys in a while. Was expecting to learn some security techniques, instead got essentially port scanned :)
Whereas I'm learning that my network is fairly secure against this type of port scanning.
app.use(cors());
If you know how CORS works, you already know that even if the resource is on localhost, it's open to any web page, including not on localhost. You won't find anything enlightening here.
If you don't know how CORS works but you're using the Express middleware for it anyway, read the documentation: https://expressjs.com/en/resources/middleware/cors.html#conf...
When will software engineers finally understand that issues like these aren't problems with some random service you run on your computer, but with the (lack of) security model behind modern web browsing?
Modern web browsing provides for this with same-origin policy. Same-origin policy can be negated by the server if it sets an overly lax CORS directive. So this is something that's secure by default, but can be broken if the "random service you run on your computer" decides to break it. I don't think that's an issue with the browser's security model.
Also if you are a front end developer and are on an insecure WiFi (coworking space or public WiFi) make sure you only bind to localhost. Otherwise other people on the network can see your frontend code which you are probably compiling with sourcemaps, which will give the attacker almost the complete source code of your SPA.)
Earlier quoted context omitted.
If like me you saw the bright red text "If you see any results like localhost:3000 is available!" as meaning :3000 was actually available, it's just an example. The yellow box above seems to be where the results would actually be.
I must admit, it was exactly this. I read the text without using my brain properly. Please accept my sincere apologies.
I only ever run my local dev server on port 80, and use a hosts file to assign custom (fake) domain names to each of the sites I want to run. I mentioned as much here a few years ago when I first came across this idea of assigning (and remembering) random unique port numbers to every one of your apps in development, and was surprised to hear that it's such a common practice. It seems sub-optimal for a lot of reasons,…
I'm sure the Container Culture Kids have their own overly-complicated thing, though.
Earlier quoted context omitted.
> expose a UI with a local web server I'm not talking about UIs hosted on local web servers being able to send requests to themselves, I'm talking about UIs hosted on REMOTE web servers being able to send requests to local ones. It seems far worse than a random cross-origin request to me and for the life of me I can't imagine uses cases.
That's not really how the internet works. What is a local webserver? Running on your machine? Running on your LAN? Running on your corporate intranet? How should a browser differentiate between these things? What qualifies as a remote server? Did you know, some very large enterprise environments squat on public IP's for private intranet internally due to address space exhaustion (IPv4 anyway)? Just because something…