workerd DevTools inspector — localhost attack demo (PoC)
Authorized security research. This page only opens connections to 127.0.0.1 on your
own machine and renders results locally — nothing is sent anywhere else.
This page is served over HTTPS: Chrome may block the WebSocket step
as mixed content. That is a browser policy layer, not a fix — workerd accepts the connection whenever the browser
allows it. Serve the page over
http:// (zone: disable Always Use HTTPS) for the full chain.Victim check: reload the worker's page afterwards.