3 ms·
Google does the silly separate domain dance GP recommended. I couldn't figure out what is it for, until I read this advice in the previous discussion. Disclaim
by lrem 6y ago
Google does the silly separate domain dance GP recommended. I couldn't figure out what is it for, until I read this advice in the previous discussion.
Disclaimer: I'm a Google SRE. But never supported anything reachable from the outside.
- alisonkisk 6y agoGoogle doesn't have a separate domain for Drive files, for example, nor do they have separate per-user domains under googleusercontent.com for photos etc
- lrem 6y agoAccording to my Firefox, the JPEG file I just tried came from googleusercontent. But you're right, it's not per-user.
- asdfasgasdgasdg 6y agoThat's not what it's for. It's to prevent user content from being served from the same origin as Google services. If the content were to be served from the same origin, scripts loaded from that origin would be able to access your google cookies and therefore would be able to access your account data.
- lrem 6y agoOh. I even heard about this mechanism before ;) Thanks, this makes more sense.