Hacker News new | past | comments | ask | show | jobs | submit login

Or a bit more generically, having a configurable allowlist of hosts, so I can make my ESP32 just a dumb "sensors on a microcontroller" thing pushing data to a RPi on my local home network, which has static IPs provided to certain devices via DHCP. Having to add an auth header isn't a great deal of work, but it'd be handy to be able to try things out quickly. IMO the great thing about all this is how frictionless it is.



I like that: I can have a thing where you can provide "localhost" but can also provide other host names and IPs too.


That approach also makes things more docker friendly.


Unfortunately the host header is spoofable


You mean the HTTP host header?

Yeah that's a good call: I need to do these checks only based on IP.

I could allow users to enter host names which I would resolve to the IP before checking though, which matches how networking is used in things like Kubernetes.




Join us for AI Startup School this June 16-17 in San Francisco!

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: