3 ms·
> Similarly, we can't use HSTS as that applies to the whole domain Is this a problem for e.g. account.bbc.com though? I can't see how that can impact bbc.com/b
by lol768 10y ago
> Similarly, we can't use HSTS as that applies to the whole domain
Is this a problem for e.g. account.bbc.com though? I can't see how that can impact bbc.com/bbc.co.uk if the header is set on the subdomain only.
I remember it used to be that e.g. news was accessed via news.bbc.co.uk but this seems to have been changed more recently to be accessible at /news. As you note, this makes HSTS a no-go because of all the other products on the same domain need to support HTTPS. This makes me wonder why this change was made in the first place. It would also seemingly mean that (without e.g. https://w3c.github.io/webappsec-suborigins/ https://w3c.github.io/webappsec-suborigins/) an XSS in one product means an XSS everywhere.
I'm sympathetic re. the SSL configurations you need to deal with and it's reassuring that this is being worked on.
- cnorthwood 10y agoAh true, I'm not close enough with the detail of some of the subdomains to know what's going on there. A few years ago a decision was made that the BBC site should be all under www.bbc.co.uk, I believe this was mostly for marketing purposes, but also to simplify our internal routing for the site. news.bbc.co.uk was previously separate as News had it's own infrastructure separate from other parts of the BBC, but that's been rationalised now (leaking subdomains for technical reasons was something we frown upon).
- whatismyip 10y agoYou're right, it's not a problem for account.bbc.com, which off the back off your parent comment I've raised pull requests to get HSTS added. To answer why that subdomain exists: firstly cookie compartmentalisation allows us to set particularly sensitive cookies off to a separate domain, as well as allowing us to do different arrangements for traffic management separate from www.