Re: [whatwg/fetch] Consider shifting the "bad port list" to an allowlist. (#1189)

> Once a PAC script is injected, it can make requests for http://some_host:80/ to http://local.domain:<forbidden_port> by setting that as a proxy for those requests. This would bypass both the port blacklist and any additional webby security features around connections to local IPs.

Malicious proxies are, indeed, bad. I agree that we need to deal with them in some way. All I'm saying here is that I'm not sure we need to deal with them via the bad port list.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/issues/1189#issuecomment-793967145