Re: [whatwg/fetch] Consider shifting the "bad port list" to an allowlist. (#1189)

@yutakahirano:
> Will private networks be covered by https://github.com/wicg/private-network-access?

Ideally, yes, but that seems somewhat orthogonal to the question here.

> Is it reasonable to require CORS preflights for requests to non-allow-listed ports?

If we wanted to go this route, I think we could more simply require TLS for non-allowlisted ports. It seems to me that encryption would substantially mitigate the Slipstream style of attack.

@MattMenke2:
> Given that proxy autoconfig remains enabled by default on Windows, I think we'll likely need to continue using the same blacklist for proxies, in practice.

I don't understand the risk here (because I know little to nothing about proxy configuration on Windows). Can a web-based attacker force a user to use a given proxy? That seems bad.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/issues/1189#issuecomment-793948745