Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

> so that range can be default exempted

I disagree. I know it’s done, but I don’t think that makes it safe or smart.

Require the user to OK it and require the server to send a header with the one _exact_ port it will access. Require that the local server _must_ use CORS and allow that server.

No website not loaded from localhost should ever be allowed to just hit random local/private IPs and ports without explicit permission.



Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: