search

WICG / private-network-access

https://wicg.github.io/private-network-access/
Other
52 stars 21 forks source link

Allow same-origin fetches to potentially-trustworthy origins #89

Closed letitz closed 1 year ago

letitz commented 1 year ago

HTTPS prevents DNS rebinding, which is the only reason we apply PNA checks to same-origin fetches.

If a fetch is made from a potentially-trustworthy origin to itself, then an attacker could only be attacking themselves. If an attacker obtains a certificate for the victim origin, then it's too late for us to do anything about it.

letitz commented 1 year ago

@johnathan79717 is looking into specifying this.