It’s more that it wasn’t prevented back when the web was first coming together, because security wasn’t on almost anyone’s minds at all. There wasn’t a hole added at some point; it’s just that browsers didn’t specifically block domains that resolve to public IPs from accessing domains that resolve to private IPs.

Realistically, it’s a backdoor to every network firewall that has existed for the entire era in which browsers were used in “secured” internal networks also connected to the internet. Everyone has either designed with it in mind, or gotten lucky that nobody tried to use it on them for like 30 years. I think it’s good to put away this footgun, but there’s no useful blame to assign here.

▲

adastra22 a day ago | parent [-]

i thought it was prevented by standard browser cross-domain security checks. Thats why I'm so surprised.

	▲	johncolanduoni 20 hours ago \| parent [-]
		Requests that need a CORS preflight will fail with any browser from the last 20 years, yes. The private IP addresses are not any more vulnerable than `www.google.com` is from `www.notgoogle.com` for cross-origin policy (subdomain-sensitive policies have a small extra vulnerability). But you’re right that doing this kind of thing without nefarious intent is an insane edge case and it should be opt-in. People spray `Access-Control-Allow-Origin: *` like it’s DDT in the 50s and half ass security in general when it’s on an intranet, so an extra guardrail is still worth it.