Stealing Secrets from Developers Localhost Development using Websockets

[Exadra37]

@chrismccord

Skimming the article, the author is using an external site that has js connect to localhost, right? If so, changing check_origin: false to check_origin: ["myapp.local"] in dev.exs with a host file entry would suffice to prevent another host from establishing a websocket connection to your local server.

What is the reason behind having check_origin: false in developments? Why not keep it as in production?