[cjbprime]

Super bad news about that: even if it didn't allow the `localhost` string, DNS rebinding allows the domain name of the site you visited to become 127.0.0.1.

The answer to why browsers allow connections to 127.0.0.1 from external sites is probably something like "legacy reasons".

[edwintorok]

DNS rebinding can be fixed at the DNS server level. OpenWRT has an option for it. But this websocket thing in browsers can't easily be turned off/mitigated AFAICT.

[bawolff]

Well if you are going to use custom software to alter how protocols work, you could just change your web browser.

[inetknght]

> DNS rebinding can be fixed at the DNS server level.

Let me know how that works with DNS over HTTP

[gruez]

>DNS rebinding can be fixed at the DNS server level

You can't always depend on that. eg. when you're on public/enterprise wifi that intercepts DNS requests.

[Avamander]

This is why a local stub is a very good idea.

[m00dy]

Or you can have this on firewall level.

[cjbprime]

No you can't -- the request from the browser is coming from inside the firewall, on an internal IP.

[m00dy]

well, I meant that there are some special firewalls that you can handle dns-rebinding attacks.

[oriettaxx]

exactly!