Every story and comment from the Hacker News API, in a layout borrowed from 2001.
A comment on Certificates for localhost. Parent comment
So you have to check Origin/Referer at least I think.
Can you be sure Origin/Referer isn’t spoofed?
Then there’s DNS rebinding which can get around the SOP.
What about maybe strange ways that malformed requests could end up being reflected back to 127.0.0.1 through rebinding?
So it just seems to me that even binding to 127.0.0.1 you have to be ready for just about anything to come in on the socket.
As far as I know, browsers forbid modifying these headers, (especially?) when making cross-origin requests.
So you have to check Origin/Referer at least I think.
Can you be sure Origin/Referer isn’t spoofed?
Then there’s DNS rebinding which can get around the SOP.
What about maybe strange ways that malformed requests could end up being reflected back to 127.0.0.1 through rebinding?
So it just seems to me that even binding to 127.0.0.1 you have to be ready for just about anything to come in on the socket.