The Tangled Web

Prohibited Ports

Security researchers have cautioned that the ability of browsers to submit largely unconstrained cross-origin request bodies, for example with <form method="POST" enctype="text/plain">, may interfere with certain other fault-tolerant but non-HTTP network services. For example, consider SMTP, the dominant mail transfer protocol: When interacting with an unsuspecting browser, most servers that speak SMTP will patiently ignore the first few incomprehensible lines associated with HTTP headers and then honor any SMTP commands that appear in the request body. In effect, the browser could be used as a proxy for relaying spam.

A related but less well-explored concern, discussed in Chapter 3, is the risk of an attacker talking to non-HTTP ...