[edwintorok]

DNS rebinding can be fixed at the DNS server level. OpenWRT has an option for it. But this websocket thing in browsers can't easily be turned off/mitigated AFAICT.

[bawolff]

Well if you are going to use custom software to alter how protocols work, you could just change your web browser.

[inetknght]

> DNS rebinding can be fixed at the DNS server level.

Let me know how that works with DNS over HTTP

[gruez]

>DNS rebinding can be fixed at the DNS server level

You can't always depend on that. eg. when you're on public/enterprise wifi that intercepts DNS requests.

[Avamander]

This is why a local stub is a very good idea.

[m00dy]

Or you can have this on firewall level.

[cjbprime]

No you can't -- the request from the browser is coming from inside the firewall, on an internal IP.

[m00dy]

well, I meant that there are some special firewalls that you can handle dns-rebinding attacks.

[oriettaxx]

exactly!