News for hackers. Stuff that matters.

A comment on Chrome team planning to block all access from browser to localhost wss. Parent comment

Re:Chrome team planning to block all access from browser to ... by justinschuh on Monday March 16, 2015 @07:42AM (#9210896)
I mentioned this above, but we plan to let the localhost/private page support an explicit opt-in, maybe via CORS headers. Those details may not be captured in the bugs yet because currently no one is actively working on this.
[ Parent | on HN ]
Re:Chrome team planning to block all access from browser to ... by jorangreef on Monday March 16, 2015 @07:47AM (#9210906)
Websockets already have the Origin header as mentioned in the bug by Tyoshino: https://code.google.com/p/chromium/issues/detail?id=378566#c...

Edit:

From my other comments, there is the additional implicit opt-in shown by WSS itself on localhost requiring (1) a public DNS record and (2) a valid SSL certificate for that FQDN.

I doubt that there are WSS servers on localhost out there setup with a public DNS record and validating SSL certificate which are not also expecting public traffic.

[ Parent | on HN ]
Re:Chrome team planning to block all access from browser to ... by justinschuh on Monday March 16, 2015 @08:08AM (#9210971)
As I explained in my other comment, the origin header in websockets doesn't help in addressing the attacks we see, because it is a server-side measure.
[ Parent | on HN ]