3 ms·

What's so "nasty" about using ALIAS? > Regarding cookies, the issue is that they are passed to subdomains so cookies that you set for `example.org` are also ac

by cbg0 7y ago

What's so "nasty" about using ALIAS? > Regarding cookies, the issue is that they are passed to subdomains so cookies that you set for `example.org` are also accessible from `*.example.org`. This is only true for cookies that are not set as `HostOnly` as far as I'm aware.

Eikon 7y ago
> What's so "nasty" about using ALIAS? It's a not standard and therefore, is not a generally applicable solution. When something not standard becomes common practice and is expected, here comes the pain.
- XelNika 7y ago
  I don't really see the issue. It changes nothing from the DNS client's perspective.
  - toast0 7y ago
    From the DNS client's perspective, there is a positive and a negative. Positive: since the server with an alias record actually returns an A/AAAA, a client doesn't have to contact any more servers to get the results. Negative: the servers for the CNAME target may be faster, relevant if the name is used beyond the A/AAAA TTL but sooner than the TTL would be set for a CNAME); or the servers for the target may be providing much finer targeting than is possibly by proxying.
- cbg0 7y ago
  > When something not standard becomes common practice and is expected, here comes the pain. I think that's the case with most popular features before they become a standard. Personally, I've used ALIAS on AWS without a hitch for years.
- SteveNuts 7y ago
  The standard should be amended for the modern web then. AWS's (and I'm sure many other's) implementation of this for their various load balancing, CDN services, etc. are critical to the health of the web now.
chrisweekly 7y ago
Re: "... only true for cookies that are not set as 'HostOnly'" Technically, you're right -- but that implies a commitment to vigilance in setting that attribute on every instance of every cookie across every page or endpoint on your apex domain. Further, if you ever want to support some use of a subdomain, you have to deal with the ability of any page therein to set cookies on ".example.com". And when you inevitably miss any instance of any of these, you're unlikely to notice, because everything will still function normally. So in practice, using the apex paints you into a corner and makes the domain less useful. There's also the issue of DDOS attacks and related problems, for which the fastest and simplest mitigation is updating DNS entries for your CNAME(s). Why take that option off the table?
belorn 7y ago
> What's so "nasty" about using ALIAS? The DNS server provide implements this differently, but the two "common" methods I know of is either aggressive caching or caching on request. In both cases the server becomes the client, breaks geoip, and create complexity where errors can easily slip in.

by cbg0 7y ago

Eikon 7y ago

> What's so "nasty" about using ALIAS? It's a not standard and therefore, is not a generally applicable solution. When something not standard becomes common practice and is expected, here comes the pain.

XelNika 7y ago
I don't really see the issue. It changes nothing from the DNS client's perspective.
- toast0 7y ago
  From the DNS client's perspective, there is a positive and a negative. Positive: since the server with an alias record actually returns an A/AAAA, a client doesn't have to contact any more servers to get the results. Negative: the servers for the CNAME target may be faster, relevant if the name is used beyond the A/AAAA TTL but sooner than the TTL would be set for a CNAME); or the servers for the target may be providing much finer targeting than is possibly by proxying.
cbg0 7y ago
> When something not standard becomes common practice and is expected, here comes the pain. I think that's the case with most popular features before they become a standard. Personally, I've used ALIAS on AWS without a hitch for years.
SteveNuts 7y ago
The standard should be amended for the modern web then. AWS's (and I'm sure many other's) implementation of this for their various load balancing, CDN services, etc. are critical to the health of the web now.

chrisweekly 7y ago

Re: "... only true for cookies that are not set as 'HostOnly'" Technically, you're right -- but that implies a commitment to vigilance in setting that attribute on every instance of every cookie across every page or endpoint on your apex domain. Further, if you ever want to support some use of a subdomain, you have to deal with the ability of any page therein to set cookies on ".example.com". And when you inevitably miss any instance of any of these, you're unlikely to notice, because everything will still function normally. So in practice, using the apex paints you into a corner and makes the domain less useful. There's also the issue of DDOS attacks and related problems, for which the fastest and simplest mitigation is updating DNS entries for your CNAME(s). Why take that option off the table?

belorn 7y ago

> What's so "nasty" about using ALIAS? The DNS server provide implements this differently, but the two "common" methods I know of is either aggressive caching or caching on request. In both cases the server becomes the client, breaks geoip, and create complexity where errors can easily slip in.