3 ms·
I think websites should just stop using "www." entirely and host directly on their domain rather than a subdomain.
by QasimK 8y ago
I think websites should just stop using "www." entirely and host directly on their domain rather than a subdomain.
- CodesInChaos 8y agoThat weakens the protection the same origin policy offers.
- ancarda 8y agoIt does? How so?
- Sohcahtoa82 8y agoAccording to this blog post[0], IE misbehaves with cookies and allows breaking SOP. The spec says that a cookie flagged with the domain "domain.com" is supposed to only be valid for requests to "domain.com" and not "subdomain.domain.com". A cookie that is intended to be valid for all subdomains is supposed to have a preceding dot, like ".domain.com". Older versions of IE (That may still be in use) will treat "domain.com" cookies like ".domain.com" cookies, allowing malicious.subdomain.domain.com to access cookies only intended for "domain.com". [0] https://www.mxsasha.eu/blog/2014/03/04/definitive-guide-to-cookie-domains/ https://www.mxsasha.eu/blog/2014/03/04/definitive-guide-to-c...
- toast0 8y agoThis is actually a lot harder than it sounds. You can CNAME www, but you can't CNAME your apex (some DNS providers pretend you can, they will resolve your CNAME for you and provide A/AAAA records to recursive resolvers -- but if you wanted to CNAME to a DNS based load balancer, that doesn't really work)
- peterwwillis 8y agoThis causes browser security problems, it creates load balancing issues, it makes failover harder, etc. Only works for small sites that don't need to be highly available.
- QasimK 8y agoWhy does it make loadbalancing and fail-overs harder?