Re: [whatwg/fetch] Reverse HTTP for CSRF/XSS-proofing of localhost webservers (Issue #1685)

That's neat, but considering the CSP changes we feel like maybe something with an uniquely allocated, opaque origin would be more appropriate?

Like, that's the real benefit of reverse HTTP: you prevent other connections altogether. And localhost webservers don't need to be able to fetch eachother - they can use standard system-level IPC instead.

(But reverse HTTP does only cover localhost...)

-- 
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/issues/1685#issuecomment-1635803888
You are receiving this because you are subscribed to this thread.

Message ID: <whatwg/fetch/issues/1685/1635803888@github.com>