No mention of iframes and cross domain Javascript for some reason. One potential attack vector if you allow user defined content on subdomains is that they can

No mention of iframes and cross domain Javascript for some reason. One potential attack vector if you allow user defined content on subdomains is that they can embed an iframe of your primary domain and they use Javascript to read the contents and execute code in it. Which they cannot do if the subdomains are different unless the page inside the frame explicitly sets "document.domain" Of course you can get a similar effect by using the "X-Frame-Options" header but if you are doing something like allowing user-defined content it is best to have layers and do different subdomains AND X-Frame-Options. Basically if you have an application that allows users to host Javascript, either use a completely different domain or make sure your root domain doesn't host any meaningful content or have cookies that are used for security or privacy.