3

By default, access to [::1] and localhost are disallowed in Microsoft Edge. One way to workaround this is to enable it in the about:flags page:

Microsoft Edge about:flags

On that label it also says (this might put your device at risk).

What risks am I exposing myself to by allowing localhost loopback?

I'm thinking that XSS wouldn't be a risk due to Same Origin Policy (unless I'm XSS-ing a site running on my own local web server, but in that case the attacker already has local control of my device).

4

One risk that can occur here is Cross-Site Request Forgery (CSRF). Say you have an application running on your localhost which presents a web server for administration purposes. If you allow localhost in a browser, when visiting a site controlled by the attacker, the attacker could request a URL such as

which if valid for the site listening on that host could cause an inadvertent action to be taken.

Now this of course requires a vulnerable service to be listening on that port, so not everyone would be at risk here. However what Microsoft have likely done is look at the trade-offs of allowing or disallowing this access and decided that for the majority use case there's more risk than benefit, so they've set this default, whilst providing a work-around if needed.

|improve this answer|||||
  • 2
    How is requesting http://localhost/admin/do_some_action?delete=yes any different from requesting something like http://mybank.com/admin/do_some_action?delete=yes? – Michael Jan 3 '17 at 23:13
  • 1
    well generally localhost is only available locally, so developers may well make an assumption that requests come from the local user and can therefore be trusted, whereas you'd hope that mybank.com would know about CSRF and defend against it. – Rory McCune Jan 4 '17 at 21:44
  • "generally localhost is only available locally" Generally, or always? – curiousguy Jun 22 '18 at 18:49
  • With the vast number of possible combinations of networking and operating system setup, it would be difficult to be absolute :) – Rory McCune Jun 24 '18 at 15:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.