3 ms·
Limit usable characters, and just literally check the page doesn't resolve already before allowing the change. Customers will never be locked out and characters
by hennell 3y ago
Limit usable characters, and just literally check the page doesn't resolve already before allowing the change. Customers will never be locked out and characters can't impersonate others.
If you want to allow some symbols you can either whitelist or check if usernames are an appropriate levenshtein distance away from core names (like say slackbot) and either ban such things or flag to a human "hey this could be an issue".
It's fundamentally hard to stop everything, but it's not hard to stop the biggest issues.
- solatic 3y ago> just literally check the page doesn't resolve already before allowing the change It's a wildcard DNS record, it always resolves, even if it's not saved in the system. There's a general rule of thumb: when someone on HN tells you to "just" do something, they generally underestimate the amount of effort involved in doing it properly.
- xp84 3y agoIt’s not hard to check, I did this recently for a script. I just resolve “(25 generated random chars).example.com” and if “interesting-subdomain.example.com” resolves to the same, then I know that the interesting one is actually only resolving because of a wildcard. If it resolves differently I know it’s taken by a real record.
- solatic 3y agoIn this particular case, the wildcards all intentionally resolved to the same address, regardless of whether or not they were already taken. Business logic was handled by looking at the Host header.