Hacker News Reader

I don't understand why DNS rebinding isn't being fixed by browser vendors. If I make an application that listens only on localhost I shouldn't have to take special steps to ensure random 3rd party remote hosts don't have access to it. The browser's DNS client could see if any recently accessed public IP now resolves to a private IP range and force a fresh CORS check.

View on HN

From the previous discussion linked above: https://news.ycombinator.com/item?id=16563135

> I regularly encounter users who don’t accept that websites can access services on localhost or their intranet. These users understand that services bound to localhost are only accessible to software running on the local machine, and that their browser is running on the local machine – but somehow believe that accessing a website “transfers” execution somewhere else. It doesn’t work like that, but this is a common source of confusion.

Reply on news.ycombinator.com