3 ms·

> This CNAME method is also a huge security issue, but I'm not gonna go into that. I will. The CNAME method could potentially allow a malicious actor to harves

by xwdv 7y ago

> This CNAME method is also a huge security issue, but I'm not gonna go into that. I will. The CNAME method could potentially allow a malicious actor to harvest user cookies, gain access to their accounts, and utterly destroy them.

sciurus 7y ago
This. At my previous job we had to serve content from Salesforce and Marketo from subdomains of our main domain. Rather than use CNAMEs direct to those companies, we proxied the requests so we could strip cookies etc.
totetsu 7y ago
How does this work exactly? asking for a friend.. (like the requests from browser to definitely-not-an-ad-subdomain.dastx.me also include cookies set by *.dastx.me content?)
- edoceo 7y ago
  Yep. Cookies frequently pass from parent domain (edoceo.com) to child (ads.edoceo.com)
lonelappde 7y ago
That's how Microsoft Teams accidentally gave away their customers' credentials to hackers, right?
- breakingcups 7y ago
  Yep, that combined with an orphaned DNS record