You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The nodeStorage server has an endpoint /httpreadurl which allows proxying everything through the server where it is installed, which can be a big security problem.
This endpoint should be removed or at least properly secured.
The range of issues this can cause is huge, you might want to read up on CORS and why it is important.
Additionally allowing to proxy everything through someones server isn't a good idea, for example someone could download illegal resources through someones server this way or cause the server to download very big files and this way take up a lot of server memory and bandwidth.
Activity
scripting commentedon Jun 13, 2016
I'm glad people are reviewing the web server interface.
Please explain why /httpreadurl is a security issue. What's the exposure?
ePirat commentedon Jun 13, 2016
The range of issues this can cause is huge, you might want to read up on CORS and why it is important.
Additionally allowing to proxy everything through someones server isn't a good idea, for example someone could download illegal resources through someones server this way or cause the server to download very big files and this way take up a lot of server memory and bandwidth.