4 ms·

Speaking of which, in this day and age, I find it inexcusable for example.com not to be a valid alias for www.example.com. (Are you listening old media??)

evincarofautumn 15y ago
Yeah, I always 301 the “www” subdomain to the real site. Some agree with us[1], some disagree[2], and some disagree disagree[3]. [1] http://no-www.org/ http://no-www.org/ [2] http://www.yes-www.org/ http://www.yes-www.org/ [3] http://www.www.extra-www.org/ http://www.www.extra-www.org/
- true_religion 15y ago
  The reason you should use a www.domain is because then you can serve static assets from a cookieless domain. If you don't use a www-domain, then you'll be setting cookies at root and they'll populate down to say static.example.com too.
  - marshray 15y ago
    But aren't there other aspects of same-origin policy that could bite you if you outsource static.example.com too? E.g., it may not stop static.example.com from setting malicious cookies at the root.
    - true_religion 15y ago
      > static.example.com from setting malicious cookies at the root. It does. Subdomains can't set cookies for other subdomains. So long as you don't read root cookies, you'll be fine even if you do put static.example.com on some companies box that gets hacked without your knowledge. However, outside of hacking (which is an issue no matter how you layout your domains), I can't think of a single problem with www-.
      - marshray 15y ago
        > So long as you don't read root cookies I wonder how many web apps are coded to reject cookies from a parent domain when they're expecting specific-subdomain cookies?
        true_religion 15y ago
        Now that you mention it... I looked did a little investigation and it turns out you can't tell where a cookie comes from. document.cookie in javascript just returns a string, and HTTP_COOKIE doesn't have any identifying information. So yes, you're right. I was wrong. You can get poisoned by cookies on a root and there's really nothing you can do about it except hope that your browser is smart enough to make prefer your good.example.com cookies as opposed to the root cookies set by evil.example.com

evincarofautumn 15y ago

Yeah, I always 301 the “www” subdomain to the real site. Some agree with us[1], some disagree[2], and some disagree disagree[3]. [1] http://no-www.org/ http://no-www.org/ [2] http://www.yes-www.org/ http://www.yes-www.org/ [3] http://www.www.extra-www.org/ http://www.www.extra-www.org/

true_religion 15y ago
The reason you should use a www.domain is because then you can serve static assets from a cookieless domain. If you don't use a www-domain, then you'll be setting cookies at root and they'll populate down to say static.example.com too.
- marshray 15y ago
  But aren't there other aspects of same-origin policy that could bite you if you outsource static.example.com too? E.g., it may not stop static.example.com from setting malicious cookies at the root.
  - true_religion 15y ago
    > static.example.com from setting malicious cookies at the root. It does. Subdomains can't set cookies for other subdomains. So long as you don't read root cookies, you'll be fine even if you do put static.example.com on some companies box that gets hacked without your knowledge. However, outside of hacking (which is an issue no matter how you layout your domains), I can't think of a single problem with www-.
    - marshray 15y ago
      > So long as you don't read root cookies I wonder how many web apps are coded to reject cookies from a parent domain when they're expecting specific-subdomain cookies?
      - true_religion 15y ago
        Now that you mention it... I looked did a little investigation and it turns out you can't tell where a cookie comes from. document.cookie in javascript just returns a string, and HTTP_COOKIE doesn't have any identifying information. So yes, you're right. I was wrong. You can get poisoned by cookies on a root and there's really nothing you can do about it except hope that your browser is smart enough to make prefer your good.example.com cookies as opposed to the root cookies set by evil.example.com