Re: Websockets and connections to private IPs and localhost from Anne van Kesteren on 2015-03-19 (public-webappsec@w3.org from March 2015)

From: Anne van Kesteren <annevk@annevk.nl>
Date: Thu, 19 Mar 2015 10:01:21 +0100
To: Devdatta Akhawe <dev.akhawe@gmail.com>
Cc: "public-webappsec@w3.org" <public-webappsec@w3.org>
Message-ID: <CADnb78g7bPyCnoe-yUkSQE+UHa8pH9HSzB24kXyp7U0FooLUaA@mail.gmail.com>

On Thu, Mar 19, 2015 at 9:46 AM, Devdatta Akhawe <dev.akhawe@gmail.com> wrote:
> In https://code.google.com/p/chromium/issues/detail?id=378566, the
> blink team is planning on blocking all connections to private networks
> and localhost. This is unfortunate, because (as discussed in the bug)
> this breaks a bunch of applications. I was wondering: instead of
> cutting down all accesses outright, can we make a compromise in
> allowing websockets to connect?

How is WebSocket different from CORS in that regard?


-- 
https://annevankesteren.nl/

Received on Thursday, 19 March 2015 09:01:44 UTC