jefftk comments on Localhost Security Messaging

jefftk 1 Jan 2023 12:42 UTC
2 points
0
In Chrome, different localhost ports are treated as the same origin

That’s not correct: the port is always part of the origin, even on localhost. You can verify this:
```
outer.html:
    <iframe src="http://localhost:8082/inner.html"></iframe>
inner.html:
    <script>window.parent.document.write("hello world");</script>
```
And then in two terminals:
```
$ python3 -m http.server 8081
$ python3 -m http.server 8082
```
If you visit http://localhost:8081/outer.html and open the console you’ll see:
```
Uncaught DOMException: Blocked a frame with origin "http://localhost:8082" from accessing a cross-origin frame.
```
While if you visit http://localhost:8081/outer.html you’ll see “hello world”.

What’s happening with zooming is that saved zoom settings are keyed by domain not origin: it always ignores the port, not just on localhost. See https://bugs.chromium.org/p/chromium/issues/detail?id=33311 and the issues that have been merged into it.

Chrome usually shows the port, but omits it from error pages

That’s not what I’m seeing; I see the port included in the URL on error pages both on localhost and not.
- jimrandomh 1 Jan 2023 23:50 UTC
  2 points
  0
  Parent
  Actually the bug linked described the intended behavior; the actual bug is https://bugs.chromium.org/p/chromium/issues/detail?id=967656&q=localhost%20zoom&can=1 which appears to have been incorrectly closed as a duplicate (of a bug which makes no mention of port numbers). Prior to ~2019 tabs on different localhost ports did not share zoom levels (I don’t recall whether there was a shared zoom level per port, or if it just didn’t share zoom levels between localhost tabs at all).
  I think you’re probably right about the CORS; I was inferring from the tab-zoom bug (which I did verify) to some speculations about other parts of origin handling (which I didn’t verify).
  When I go to localhost:1234 (a port number with nothing on it, the error page looks like this (note the localhost with no port number). (The port number is still in the address bar though.)