21 ms·
I think this misses a whole section on security. e.g. https://security.stackexchange.com/questions/33851/protecting-against-cross-subdomain-cookie-attacks http
by donalhunt 10y ago
I think this misses a whole section on security.
e.g. https://security.stackexchange.com/questions/33851/protecting-against-cross-subdomain-cookie-attacks https://security.stackexchange.com/questions/33851/protectin...
- tarr11 10y agoThat's a great link, I will add it in. Thanks.
- donalhunt 10y agoI think you're kind of missing my point. This space is a lot more complicated that the page indicates and the usual warning of "a little knowledge is a dangerous thing..." applies. Some additional context: - https://security.googleblog.com/2012/08/content-hosting-for-modern-web.html https://security.googleblog.com/2012/08/content-hosting-for-... - https://en.wikipedia.org/wiki/Same-origin_policy https://en.wikipedia.org/wiki/Same-origin_policy - and other articles on CORS, XSS and CSRF, etc
- tarr11 10y agoIs there some statement that I wrote that you believe is misleading or incorrect? I'm trying to warn people off of subdomains, rather than encourage it.