3 ms·
It's the other way around. The main site is example.com and the ads/tracking are at ads.example.com (which is a CNAME pointing to some server controlled by the
by nybble41 6y ago
It's the other way around. The main site is example.com and the ads/tracking are at ads.example.com (which is a CNAME pointing to some server controlled by the advertiser). So they have the same second-level domain and are considered related origins.
Of course ads.example.com could just as well have A/AAAA records pointing to the same ad server, which would neutralize any attempt to infer separate origins based on CNAME records. It would just be slightly more difficult to administer since the owner of example.com would need to update their DNS records whenever the ad server's IP address changed—but that could be automated, and the IPs are probably mostly static anyway.
- mildred593 6y agoI always thought that was a bad decision, thinking that subdomains could be related security-wise to other domains looking the same. DNS was thought out from the beginning so you could split it anywhere you wanted to delegate things, and you can also delegate with CNAME too. I'd welcome a security model that does not use origins. It's doable, but the origin trick was a convenient way to enforce some security measures bolted on as an after thought without breaking much the compatibility.
- JdeBP 6y agoIt's called "CNAME Flattening" (or "ALIAS records") and has been widely available from hosting providers since 2014. I was talking about server-side aliases a decade before that, and I was far from the only person doing so. You have the explanation right. But your hypothetical future dystopia is actually the world of today. (-: