Re: [xwt-users]Security, connection to servers

Eric Merritt <cyberlync-/[email protected]>
Newsgroups gmane.comp.java.xwt.users
Message-ID <[email protected]>
Adam,

 If your application is coming from the intranet (10.*
and 192.*) I don't see why it couldn't connect to
another intranet address. I realize why an internet
application should be limited to the internet. 

 I guess I just don't see why the same logic you apply
to the internet is not applied to intranets. I am not
trolling here, or seeking to cuase animosity. I really
would like to understand what security concerns you
have about this.

Thanks,
Eric

--- Adam Megacz <[email protected]> wrote:
> 
> The authoritative source for the answer to this
> question is the
> reference.  It and the source code both limit you to
> only the IP
> address the xwar came from.  This is the intended
> behavior; allowing
> any IP address would create a severe security hole.
> 
>   - a
> 
> Eric Merritt <cyberlync-/[email protected]> writes:
> > --- Brian Alliet <[email protected]> wrote:
> > > From: "Eric Merritt" <cyberlync-/[email protected]>
> > > > > > No, when an xwar is loaded from an
> intranet
> > > > > location it can connect to
> > > > > > anything.
> > > >
> > > >  This is what I would think it would be.
> > > >
> > > > > Nope, he was right. It can just connect to
> the
> > > host
> > > > > where the xwar came
> > > > > from.
> > > >
> > > > So which is it?
> > > 
> > > Well, according to the source, xwars loaded from
> > > private ip ranges can only
> > > connect to the server they came from. See
> HTTP.java,
> > > resolveAndCheckIfFirewalled.
> > > 
> > >
> >
>
http://cvs.xwt.org/xwt/src/org/xwt/HTTP.java?rev=1.31&content-type=text/x-cv
> > > sweb-markup
> > > 
> > 
> >  Arghh, I guess I could put together a little
> patch
> > for that, that I could apply to the local
> launcher.
> > hmmm, I will have to look into that.
> > 
> > __________________________________
> > Do you Yahoo!?
> > SBC Yahoo! DSL - Now only $29.95 per month!
> > http://sbc.yahoo.com
> > 
> > _______________________________________________
> > users mailing list
> > [email protected]
> > http://lists.xwt.org/listinfo/users
> > 
> 
> -- 
> 
> _______________________________________________
> users mailing list
> [email protected]
> http://lists.xwt.org/listinfo/users


__________________________________
Do you Yahoo!?
SBC Yahoo! DSL - Now only $29.95 per month!
http://sbc.yahoo.com
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.