0

I am writing a rails app that comes with a local program for the user to run. That program creates a nodeserver which connects to the user's browser through websockets. Upon certain actions by the user in the browser, a signal will be sent through the socket to the local node server which will execute a pre-defined command on the user's local machine. The command differs depending on the user's specific action in the browser, but there is no way for the user to send custom data to the local node server(ie different actions send pre-defined information to the local server). I was wondering if there are security implications to doing this, and what some possible exploits might be if so.

kempchee
  • 470
  • 1
  • 4
  • 17
  • If this is local only, you really can't worry about security the user eventually has control over everything. If you want to "shield" the user against unauthorized access, try to implement some basic authentication. – Gntem Mar 06 '14 at 22:16

1 Answers1

1

I had troubles working on a Chrome Extension communicating with a local environment with this:

Maybe you can have problems with HTTP access control (CORS) and gem CORS could fix if that happens http://rubygems.org/gems/cors

Another possible problem may be "406 not acceptable" because of CORS.

Community
  • 1
  • 1
skozz
  • 2,662
  • 3
  • 26
  • 37