starred/yaak-mountain-loop
1
0
Fork 0
mirror of https://github.com/mountain-loop/yaak.git synced 2026-08-25 04:44:12 +02:00
Code Issues 8 Packages Projects Releases 10 Wiki Activity

Refuse private ranges unconditionally; the proxy's network is never the user's

Browse Source
This commit is contained in:
Gregory Schier
2026-08-17 11:00:39 -07:00
parent 58d625cc39
commit 679e49d1eb
5 changed files with 17 additions and 40 deletions
Download Patch File Download Diff File Expand all files Collapse all files
packages/platform/src/web/README.md
+3 -1
View File
@@ -208,7 +208,9 @@ template *function* (`${[ timestamp() ]}`) or an authentication plugin (bearer,
basic, OAuth, …) is refused before anything leaves the tab, with a message naming
what it needs; those light up when plugins run in the browser. Requests with a
file body or multipart file fields are refused by the proxy (it has no access to
your files, and must not read its own).
your files, and must not read its own). And a request to `localhost` or a LAN
address can't work from a browser: the proxy runs elsewhere and refuses private
ranges outright — reaching your own machine's APIs is what the desktop app is for.
The proxy URL is `VITE_YAAK_SEND_PROXY_URL` at build time, defaulting to
`http://127.0.0.1:9227` (see `proxy.ts`). Run one with `cargo run -p yaak-send-proxy`.