LAN capability

[jbrown]

Could you please explain the new LAN capability? What does "cross-zone WAN to LAN requests" exactly mean?

[Giorgio Maone]

In a nutshell, the LAN capability allows pages from the Internet (World Area Network / WAN) to link / send requests to hosts inside your Local Area Network (LAN), which is pretty much the current state of affairs and allows so called cross-zone CSRF/XSS attacks.
By keeping it disabled (as it is by factory setting in the DEFAULT and UNTRUSTED presets), you're replicating in an easier GUI way (no firewall-like rules involved) this feature from "Classic" NoScript.

[Quest]

Looks like if old custom settings allow Script then LAN is automatically allowed now?
Why. Or is it so?

[Giorgio Maone]

Looks like if old custom settings allow Script then LAN is automatically allowed now?
Why. Or is it so?

Correct. Not to disrupt stuff that's currently working and forcing people to make a CUSTOM rule.
It's not like LAN is giving sites a new capability (without NoScript they can already send requests to the LAN): it's that the user now can turn this capability off, and by DEFAULT (on sites you don't trust) is already turned off.
If you prefer to have it off everywhere, you can do it as well by modifying the TRUSTED preset.

[barbaz]

Added to the sticky - viewtopic.php?f=7&t=26285