Block HTTP port 10080

Category: Network / Connectivity
Type: No developer-visible change
Status: Enabled by default (Chrome 91)
Intent stage: Shipped

Breaking change: No
Enterprise impact: None
Spec maturity: Incubation
Web Platform Tests: Yes

WPT details: https://wpt.fyi/results/fetch/api/request/request-bad-port.any.html?label=experimental&label=master&aligned

Summary

Connections to HTTP, HTTPS or FTP servers on port 10080 will fail. This is a mitigation for the NAT Slipstream 2.0 attack. It helps developers by keeping the web platform safe for users.

Motivation

Mitigation for the NAT Slipstreaming attack: https://samy.pl/slipstream/. Preserves user confidence in the web by preventing their browser being used as a vector to attack their internal network.

Standards & signals

Specification: https://fetch.spec.whatwg.org/#bad-port
Firefox: Shipped/Shipping
Safari: In development — Change landed in WebKit: https://bugs.webkit.org/show_bug.cgi?id=224432.
Web developers: Positive

Ecosystem

Web Platform Tests: https://wpt.fyi/results/?q=fetch%2Fapi%2Frequest%2Frequest-bad-port
Chrome Platform Showcase: https://chrome-platform-showcase.paulkinlan-ea.deno.net/features
GenDN reference: https://gendn.paulkinlan-ea.deno.net/features
chrome.dev demos search: https://www.google.com/search?q=site%3Achrome.dev+Block%20HTTP%20port%2010080
MDN Web Docs: https://developer.mozilla.org/en-US/search?q=Block%20HTTP%20port%2010080
Baseline status: https://webstatus.dev/?q=Block%20HTTP%20port%2010080

View on chromestatus.com