Feedback wanted: CORS for private networks (RFC1918)
1–10 of 54 posts
Re: Feedback wanted: CORS for private networks (RFC1918)
#2I am thinking of use cases and I think one would be folding@home. Their Web client is hosted on their public website and it makes http calls to a localhost:port running on a background service. Is that correct or have I misunderstood?
Re: Feedback wanted: CORS for private networks (RFC1918)
#3The example feedback goes a bit in that direction, but how would that interact with mixed content?
Say, I have a server running on 192.168.1.1. The box is only accessible through its IP address, so I can't get a public certificate for it and therefore can't enable https.
I cannot access the box from a http site due to the new restriction.
I cannot access the box from a https site due to mixed content.
So I cannot access the box anymore at all?
Re: Feedback wanted: CORS for private networks (RFC1918)
#4The example feedback goes a bit in that direction, but how would that interact with mixed content? Say, I have a server running on 192.168.1.1. The box is only accessible through its IP address, so I can't get a public certificate for it and therefore can't enable https. I cannot access the box from a http site due to the new restriction. I cannot access the box from a https site due to mixed content. So I cannot acc…
> So I cannot access the box anymore at all?
My understanding is that you can access it directly. But you can't embed e.g. images or JavaScript from that server within a website running on a public IP address. I consider that a good thing.
Re: Feedback wanted: CORS for private networks (RFC1918)
#5Fuck this. It increases the complexity of browsers and servers and erects yet another burden for makers. And for what? So orgs with broken infrastructure (and budgets for running it) and device manufacturers (with budgets of their own) can keep up their garbage practices instead of fixing them? And they can push their costs onto a deep-pocketed company like Google who's willing to subsidize them? Here's to hoping that WebKit and Mozilla say "No."
Re: Feedback wanted: CORS for private networks (RFC1918)
#6I don't get it. What's wrong with normal CORS? They do work for private networks. Also I don't think browsers are the right place to do this kind of protection.
Re: Feedback wanted: CORS for private networks (RFC1918)
#7Requiring HTTPS for services on the private network seems rather extreme. How do you even do HTTPS on a private network not attached to some publicly-resolvable external domain without installing the root certificate on all devices?
Re: Feedback wanted: CORS for private networks (RFC1918)
#8I am thinking of use cases and I think one would be folding@home. Their Web client is hosted on their public website and it makes http calls to a localhost:port running on a background service. Is that correct or have I misunderstood?
Yes, but since they control the background service too, they can just update the service to make it respond to CORS requests.
Re: Feedback wanted: CORS for private networks (RFC1918)
#9Requiring HTTPS for services on the private network seems rather extreme. How do you even do HTTPS on a private network not attached to some publicly-resolvable external domain without installing the root certificate on all devices?
Zero-trust architecture would note that there's not really anything 'private', once the traffic is 'inside'. The old way of thinking with firewalls and DMZs falls apart now, so you have to treat all traffic, even what you think of as "inside" as potentially hostile or disruptive. Thus, TLS everywhere.
How to do it? self-signed certs and distribute your own CA and install it across devices that are authorized to be on your network.
Re: Feedback wanted: CORS for private networks (RFC1918)
#10Fuck this. It increases the complexity of browsers and servers and erects yet another burden for makers. And for what? So orgs with broken infrastructure (and budgets for running it) and device manufacturers (with budgets of their own) can keep up their garbage practices instead of fixing them? And they can push their costs onto a deep-pocketed company like Google who's willing to subsidize them? Here's to hoping tha…
It's probably wrong to consider any 'private' network to be secure any more. With zero-trust principles in mind, you wouldn't necessarily believe every device or system on your network is trusted, so you ensure that what is able to send and receive traffic on your network has other mechanisms in place for trust and authenticity.