4 ms·
Lol that's the least of the concerns. If you allow customers to publish on subdomain, let's say example.quickpublisher.online, the customer site will receive a
by user5994461 6y ago
Lol that's the least of the concerns.
If you allow customers to publish on subdomain, let's say example.quickpublisher.online, the customer site will receive all cookies from the top domain quickpublisher.online (read: user sessions), this allows to trivially steal user accounts from other customers visiting the site, then take over their resources or credit cards (assuming there is some payments attached to the account).
TLDR; If you're a customer, go shutdown your account quick before it's stolen. This product is a security disaster that should never have been shipped like that.
- estacado 6y agoWordpress.com does this. Are those sites at risk too?
- user5994461 6y agoGood question! You will see that you are logged in as yourself if you access any wordpress.com website, your session is shared with all blogs. It allows you to post comments as yourself without captcha for example. Historically wordpress controls the entire platform. It notably doesn't allow users to post raw HTML or any javascript, or load any wordpress plugins. There is only a basic text editor to write blog articles. As a customer you wouldn't be able to intercept cookies because you don't have any control on your site (you can't even load javascript for google or amazon ads which is super annoying). They've added some plugin support in the past year and few other things, so this might have opened some unnoticed loopholes. Notwithstanding any novelty, wordpress is locked really tight and designed with this in mind, it's safe.
- rotimi_je_suis 6y agoHere I use wildcards. The subdomains are not created on my domain.