4 ms·
Is there a feature of DNS I'm unaware of, that queries more than just the domain part? https://example.com?token=<secret> https://example.com?token=<secret> sho
by andix 3y ago
Is there a feature of DNS I'm unaware of, that queries more than just the domain part? https://example.com?token=<secret> https://example.com?token=<secret> should only lead to a DNS query with "example.com".
- erikerikson 3y agoThe problem isn't DNS in GP. DNS will happily supply the IP address for a CDN. The HTTP[S] request will thereafter be sent by the caller to the CDN (in the case of CloudFlare, Akamai, etc.) where it will be handled and potentially logged before the result is retrieved from the cache or the configured origin (i.e. backing server).
- andix 3y agoThis sounds like a big security flaw in the system that uses access links. Secrets should not be logged (in most cases). When opening a Dropbox/GoogleDocs/OneDrive link, I expect the application not to route them through potentially unsafe CDNs.
- r2b2 3y agoCorrect, DNS only queries the hostname portion of the URL. Maybe my attempt to be thorough – by making note of DNS along side HTTP since it's part of the browser ↔ network ↔ server request diagram – was too thorough.