4 ms·
The article suggests using WWW for DNS compatibility, but... Everything it mentions in prefer for WWW can be solved by a combination of static IP and CDN. My
by austincheney 8y ago
The article suggests using WWW for DNS compatibility, but...
Everything it mentions in prefer for WWW can be solved by a combination of static IP and CDN. My site's domain, for example, has a domain with a static IP and the site is served by HTTPS. Certificate resolution for the HTTPS goes to CloudFlare which also serves as a CDN for everything retrieved from the domain. CloudFlare provides firewall and security options as a feature of its CDN capabilities.
Because I am already solving for all the DNS and application concerns mentioned by the article I choose to use the more sane approach and simply drop use of a default subdomain.
EDIT:
I also detest cookies. They can store virtually nothing at 4kb per domain and the cookie API is horrible. Instead I use localStorage for all storage concerns and share explicitly anything that needs to be shared via XHR, which currently is nothing.
- asaph 8y ago> ... and the cookie API is horrible. What don't you like about it?
- austincheney 8y agoIt is arguably worse than the Date api. https://developer.mozilla.org/en-US/docs/Web/API/Document/cookie https://developer.mozilla.org/en-US/docs/Web/API/Document/co... Compare all that madness to the localStorage API: localStorage.myName = "string up to 5mb"; Attempting to delete a cookie makes me want to abandon coding. Removing from localStorage is as easy as: delete localStorage.myName;
- asaph 8y agoThe client-side API for cookies is irrelevant since it's disabled when the httponly flag is set on a cookie. And all cookies should have httponly set to true for security reasons. You should only be using server-side APIs for cookie management. Many good ones exist. Reference: https://www.owasp.org/index.php/HttpOnly https://www.owasp.org/index.php/HttpOnly
- austincheney 8y ago> You should only be using server-side APIs for coookie management. No. I will use any string I want of any size I want. Cookies are a relic of an archaic age for the web. Cookies only continue to be used because many server based web applications haven't figured out a modern way for managing sessions.
- asaph 8y agoStoring arbitrary data in a cookie isn't a secure best-practice anyway. You shouldn't store actual data in cookies, just a meaningless token (aka session-id) that is used to look up session data on the server side. If you insist on using local storage, please be aware that it's unsuitable for storage of any sensitive data for the same security reasons that the httponly cookie flag exists. Don't let your API elegance preferences be the only factor in your architecture design choices. Please consider security too as you may be putting your users at risk. Design choices in this area are more nuanced than you seem to be aware of.
- hacknat 8y agoNot everyone can get a static IP for their site and if everyone did we would be out of IPs.
- rebane2001 8y agoIt's done using a CDN. Eg CloudFlare has an IP your website is on, but also where many other websites on the same IP
- Avamander 8y agoEveryone can get a static IPv6 IP.
- system2 8y agoGood luck typing it.
- austincheney 8y agoWe are out of IPs regardless, at least IPv4 addresses. We are nowhere close to running low on IPv6 addresses.
- dbrgn 8y agoCookies and local storage are two different things. Use local storage if you want to store data on the client. Use cookies if you want to share data with the server. And regarding Cloudflare: Terminating your TLS session on a third party provider's server also has it's downsides.