A proposal to restrict sites from accessing a users' local network

Re:A proposal to restrict sites from accessing a users' loca... by afavour on Thursday June 05, 2025 @10:19AM (#44191973)

I think you’re making those restrictions out to be bigger than they are.

Does no-cors allow a nefarious company to send a POST request to a local server, running in an app, containing whatever arbitrary data they’d like? Yes, it does. When you control the server side the inability to set custom headers etc doesn’t really matter.

[ Parent | on HN ]

Re:A proposal to restrict sites from accessing a users' loca... by jonchurch_ on Thursday June 05, 2025 @10:36AM (#44192115)

My intent isnt to convince people this is a safe mode, but to share knowledge in the hope someone learns something new today.

I didnt mean it to come across that way. The spec does what the spec does, we should all be aware of it so we can make informed decisions.

[ Parent | on HN ]