3 ms·
And how else would you let your users have a subdomain login url? Why bother generating specific certs and dns for each when you can just use the HOST header fo
by cyberpunk 10y ago
And how else would you let your users have a subdomain login url? Why bother generating specific certs and dns for each when you can just use the HOST header for the login and use a wildcard?
This is totally common and used in a lot of places..
I mean:
https://bigger.bag.of.dicks.signin.aws.amazon.com/ https://bigger.bag.of.dicks.signin.aws.amazon.com/
- chris_wot 10y agoBecause those Certs weren't designed for this scenario. The fact that you can create that domain name to resolve is funny. I can think of a few phishing schemes I could use with this, if I were so inclined.
- cyberpunk 10y agoThis was designed for exactly that sort of scenario. If you're runnin a SAAS then this is totally common practice, it's used by at least AWS, Slack, and GitHub off the top of my head.. Are you saying these companies are doing something stupid? How could you phish github or aws by using their dns/cert setup as they intended it to be used?