4 ms·
My immediate thought is that they did this for browser security reasons, like how they use github.io for Github Pages.
by pronoiac 9y ago
My immediate thought is that they did this for browser security reasons, like how they use github.io for Github Pages.
- wyldfire 9y agoBut isn't that governed by the same origin policy, which cares about specific hosts (so a subdomain would be equally effective)?
- hdhzy 9y agoSubdomain can set a cookie for root domain [0] and that can lead to session fixation attacks. Cookies are not subject to CORS. [0]: https://www.mxsasha.eu/blog/2014/03/04/definitive-guide-to-cookie-domains/ https://www.mxsasha.eu/blog/2014/03/04/definitive-guide-to-c...