4 ms·

Thanks. For my SAAS app where I need to issue <<customername>>.<<mydomain>>.com it will be very expensive to start with if I do not go for wildcard. I understa

by skrish 15y ago

Thanks. For my SAAS app where I need to issue <<customername>>.<<mydomain>>.com it will be very expensive to start with if I do not go for wildcard. I understand the risk & re-certification issue and will look into this further.

marshray 15y ago
You should fully understand the same-origin implications of such a design before deploying it. For example, if <<customername>> is able to set cookies or run script (e.g., via XSS), they will be able to set cookies that affect everything under <<mydomain>>.com. Under some circumstances they will even be able to read back the values. Here's a good site to keep you awake at night: http://lcamtuf.blogspot.com/2010/10/http-cookies-or-how-not-to-design.html http://lcamtuf.blogspot.com/2010/10/http-cookies-or-how-not-...