Skip to content

Commit f435291

Browse files
facutuescaTrottRafaelGSS
authored
guide: fix outdated section in debugging guide (#4732)
This removes `localhost6` from the domains that Node.js accepts in connections to the debugging inspector. It was removed due to being vulnerable to DNS rebinding attacks. See CVE-2021-22884 for more details. Co-authored-by: Rich Trott <rtrott@gmail.com> Co-authored-by: Rafael Gonzaga <rafael.nunu@hotmail.com>
1 parent fec1f51 commit f435291

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed

locale/en/docs/guides/debugging-getting-started.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -59,7 +59,7 @@ unique debugger session id. The same-origin-policy prevents websites from being
5959
able to make this HTTP connection. For additional security against
6060
[DNS rebinding attacks](https://en.wikipedia.org/wiki/DNS_rebinding), Node.js
6161
verifies that the 'Host' headers for the connection either
62-
specify an IP address or `localhost` or `localhost6` precisely.
62+
specify an IP address or `localhost` precisely.
6363

6464
These security policies disallow connecting to a remote debug server by
6565
specifying the hostname. You can work-around this restriction by specifying

0 commit comments

Comments
 (0)