News for hackers. Stuff that matters.

A comment on Feedback wanted: CORS for private networks (RFC1918).

Re:Feedback wanted: CORS for private networks (RFC1918) by djweis on Tuesday November 10, 2020 @11:01PM (#25055386)
Assuming I'm running malware.com, I would make 192-168-0-1.router.malware.com resolve to 192.168.0.1 so the origin matches and I can prod the router as much as I'd like without crossing the origin.
[ Parent | on HN ]
Re:Feedback wanted: CORS for private networks (RFC1918) by xg15 on Wednesday November 11, 2020 @01:42AM (#25056074)
The proposal talks about sites resolving to private/local addresses, so presumably, the browser would still apply the checks to all requests to that domain.

The only thing that would not trigger CORS is if you somehow loaded a top-level document from that domain. (The address is in the browser's address bar) - however, a malicious website can't do that as this server is not under their control.

[ Parent | on HN ]
Re:Feedback wanted: CORS for private networks (RFC1918) by mikewest on Wednesday November 11, 2020 @11:57AM (#25060066)
Correct. https://wicg.github.io/cors-rfc1918/#dns-rebinding describes this reasoning.
[ Parent | on HN ]