News for hackers. Stuff that matters.

A comment on A proposal to restrict sites from accessing a users' local network. Parent comment

Re:A proposal to restrict sites from accessing a users' loca... by Thorrez on Thursday June 05, 2025 @09:12AM (#44191382)
>Why should websites ever have access to the local network?

It's just the default. So far, browsers haven't really given different IP ranges different security.

evil.com is allowed to make requests to bank.com . Similarly, evil.com is allowed to make requests to foo.com even if foo.com DNS resolves to 127.0.0.1 .

[ Parent | on HN ]
Re:A proposal to restrict sites from accessing a users' loca... by chuckadams on Thursday June 05, 2025 @09:42AM (#44191629)
> It's just the default. So far, browsers haven't really given different IP ranges different security.

I remember having "zone" settings in Internet Explorer 20 years ago, and ISTR it did IP ranges as well as domains. Don't think it did anything about cross-zone security though.

[ Parent | on HN ]