Noob question on security of localhost

Question

This may already have been answered, but I'm having difficulty understanding the technical jargon of various posts. I have to give a Callback URL to receive some sort of validation, to use an API. Does providing my localhost url (https://...), make it possible for someone on the other end (e.g. the people that run the API) to get into my computer? Also, am I able to provide the localhost url whilst using a VPN? Thanks and apologies for the simpleton nature of this post:)

Answer 1

Localhost is the name that each computer (most computers) has on its loopback interface. You should see this interface as an interface that is attached only to your local system. By definition, the whole 127.0.0.0/8 (or ::1/128 for IPv6) subnet is reserved for this interface. Only your own computer can access this network.

If your service only listens to the loopback address, then the client must be on that loopback network too. And there is only one interface (loopback) on that network.

You can also look at it from the point of IP routing. Suppose I have two computers. A wants to talk to the loopback interface of B. So, what would the IP address be? 127.0.0.1. But that is already A's own loopback interface, so A will try to connect to its own loopback interface and not that of B.

Now, your question is "is it possible", then the answer is that perhaps, having control over both computers, I could start routing on B and get A off the standard 127.0.0.1 for its loopback, than maybe if A and B are on the same switch (L2 connected) I could perhaps make it work. But for all practical purposes:

• An url https://localhost or http://127.0.0.1 cannot be reached from outside your computer
• A VPN is for this like an ordinary network, and, as explained that won't work either.

Answer 2

I have to give a Callback URL to receive some sort of validation, to use an API.

I assume that you are talking about a callback URL as in this scenario: this will be the URL where the server will redirect the browser to after a successful authentication.

Note that the server cannot directly access localhost from outside and usage of VPN does not matter. But a malicious server could use a different URL than you've given for callback, i.e. http://localhost/evil instead of http://localhost/sane. In this case your browser would issue a request to http://localhost/evil which might exploit bugs in your web application. See CSRF attacks for more on this. In other words: direct attacks from outside would not be possible but indirect might be.