What Makes .NET Core So Special?

Re:What Makes .NET Core So Special? by euroclydon on Friday November 09, 2018 @06:05AM (#18413650)

It's probably less secure by default. Make sure to reject all HTTP requests where the Origin header doesn't match the local server host, or just all request with an Origin header.

[ Parent | on HN ]

Re:What Makes .NET Core So Special? by CodesInChaos on Friday November 09, 2018 @09:18AM (#18414475)

What you really need is a shared secret between (embedded) browser and (local) server.

IP, host header, origin header can be checked as defense in depth, but can't prevent local privilege escalation from non browser clients and are quite fragile even in browsers.

(or use a secure non TCP/IP based communication channel)

[ Parent | on HN ]

Re:What Makes .NET Core So Special? by euroclydon on Monday November 12, 2018 @03:49PM (#18435638)

> but can't prevent local privilege escalation from non browser clients

That is such a different threat model though. A native app has a lot more permissions than a web page. Trying to protect one native app from another is not really done much. Like, are MS Word documents encrypted so Slack can't read them from disk?

[ Parent | on HN ]

Re:What Makes .NET Core So Special? by CodesInChaos on Wednesday November 14, 2018 @10:30AM (#18450562)

You can have multiple OS users on the same computer.

[ Parent | on HN ]