4 ms·
Looks like they had a misconfiguration slip out; it was an internal domain but somehow began being used to serve favicons.
by andylynch 4y ago
Looks like they had a misconfiguration slip out; it was an internal domain but somehow began being used to serve favicons.
- logifail 4y ago> it was an internal domain That may also be (tangentially) true, but someone also paid _actual_ money to register the _actual_ .digital domain. Was this 'someone' really uk.gov? If so, why?
- kevingadd 4y agoIf you're going to use a domain internally, you should really own it. Otherwise someone else could buy it and potentially hijack requests.
- logifail 4y agoSo why is using .govuk.digital for internal services - while still having to purchase and renew the actual govuk.digital domain - preferable to, say, setting everything up under .internal.gov.uk?
- dndvr 4y ago- To reduce the attack surface In the event of site with a *.gov.uk subdomain getting compromised at least it won't now be able to steal auth cookies for internal services - to keep test/stage as faithful a copy of prod as possible they will have a totally separate but the same DNS set up/CDN set up/ load balancing etc. Theoretically the only difference would need to be one routing rule rather than stuff that might start creating edge case bugs with certs/cookies etc where there are different numbers of segments in domains. Also allows for more certainty/confidence when something is tested in a lower environment that it will work when promoted to prod
- kevingadd 4y agoIt's good security practice to have separate sandboxes/domains for various types of services so it's harder for people to pivot from one to another in the event of an exploit. Similar to having a different domain for internal services, if you host user content on your site you should host all that user generated content on a different domain so it can't access your cookies etc.