4 ms·

> By default, your blog gets published on a .quickpublisher.online sub domain. Please be careful: don't let users publish on your domain or even a subdomain of

> By default, your blog gets published on a .quickpublisher.online sub domain. Please be careful: don't let users publish on your domain or even a subdomain of your business domain. If they post something someone don't like you risk that your email and statis page and everything goes down because someone asks your DNS provider to take you offline. Just buy another domain: quickpublisher.<whatever> and use that for user generated content.

rotimi_je_suis 6y ago
Thanks for the advice. I'll be sure to implement it
- neya 6y ago
  Consider using something like this: https://github.com/dsignr/disallowed-usernames https://github.com/dsignr/disallowed-usernames Disclaimer: I'm the author
  - rotimi_je_suis 6y ago
    You're a life saver! Thank you! This makes it easier to implement in my platform.
user5994461 6y ago
Lol that's the least of the concerns. If you allow customers to publish on subdomain, let's say example.quickpublisher.online, the customer site will receive all cookies from the top domain quickpublisher.online (read: user sessions), this allows to trivially steal user accounts from other customers visiting the site, then take over their resources or credit cards (assuming there is some payments attached to the account). TLDR; If you're a customer, go shutdown your account quick before it's stolen. This product is a security disaster that should never have been shipped like that.
- estacado 6y ago
  Wordpress.com does this. Are those sites at risk too?
  - user5994461 6y ago
    Good question! You will see that you are logged in as yourself if you access any wordpress.com website, your session is shared with all blogs. It allows you to post comments as yourself without captcha for example. Historically wordpress controls the entire platform. It notably doesn't allow users to post raw HTML or any javascript, or load any wordpress plugins. There is only a basic text editor to write blog articles. As a customer you wouldn't be able to intercept cookies because you don't have any control on your site (you can't even load javascript for google or amazon ads which is super annoying). They've added some plugin support in the past year and few other things, so this might have opened some unnoticed loopholes. Notwithstanding any novelty, wordpress is locked really tight and designed with this in mind, it's safe.
  - rotimi_je_suis 6y ago
    Here I use wildcards. The subdomains are not created on my domain.

rotimi_je_suis 6y ago

Thanks for the advice. I'll be sure to implement it

neya 6y ago
Consider using something like this: https://github.com/dsignr/disallowed-usernames https://github.com/dsignr/disallowed-usernames Disclaimer: I'm the author
- rotimi_je_suis 6y ago
  You're a life saver! Thank you! This makes it easier to implement in my platform.

user5994461 6y ago

Lol that's the least of the concerns. If you allow customers to publish on subdomain, let's say example.quickpublisher.online, the customer site will receive all cookies from the top domain quickpublisher.online (read: user sessions), this allows to trivially steal user accounts from other customers visiting the site, then take over their resources or credit cards (assuming there is some payments attached to the account). TLDR; If you're a customer, go shutdown your account quick before it's stolen. This product is a security disaster that should never have been shipped like that.

estacado 6y ago
Wordpress.com does this. Are those sites at risk too?
- user5994461 6y ago
  Good question! You will see that you are logged in as yourself if you access any wordpress.com website, your session is shared with all blogs. It allows you to post comments as yourself without captcha for example. Historically wordpress controls the entire platform. It notably doesn't allow users to post raw HTML or any javascript, or load any wordpress plugins. There is only a basic text editor to write blog articles. As a customer you wouldn't be able to intercept cookies because you don't have any control on your site (you can't even load javascript for google or amazon ads which is super annoying). They've added some plugin support in the past year and few other things, so this might have opened some unnoticed loopholes. Notwithstanding any novelty, wordpress is locked really tight and designed with this in mind, it's safe.
- rotimi_je_suis 6y ago
  Here I use wildcards. The subdomains are not created on my domain.