4 ms·

The issue is everyone loves to have everything fronted by a single domain. Most of xss is because of this basic flaw. All of this could have been avoided if dis

The issue is everyone loves to have everything fronted by a single domain. Most of xss is because of this basic flaw. All of this could have been avoided if discord didn't run their API docs through discord.com

__float 10mo ago
It's a bit surprising they did that, to be honest. I work at a similarly-sized, HN-popular tech company and our security team is very strict about less-trusted (third party!!) code running on another domain, or a subdomain at the very least, with strict CSP and similar. But in the age of AI, it seems like chasing the popular thing takes precedence to good practices.
staticassertion 10mo ago
This is what it really comes down to. Browsers are built around origins as the major security boundary. When you use a separate origin, safety comes for free.
- mock-possum 10mo ago
  Trust doesn’t though - discord.com/docs looks legit, as does docs.discord.com - discord-docs.com immediately sets off red flags
  - brap 10mo ago
    Is there no way to tell the browser “hey this URL is using the same domain but please isolate it from the rest”?
    - staticassertion 10mo ago
      You can use a sandboxed iframe without an origin.
  - staticassertion 10mo ago
    You can still have discord.com/docs with content hosted on discord-docs.com
- integralid 10mo ago
  And you open another can of worms which is phishing. If you run your marketing campaigns from yourcompany-deals-2025.com don't be surprised when people click yourcompany-login.com links
  - staticassertion 10mo ago
    I'm not sure I understand. edit: That is, your phishing approach would work regardless, in my opinion. If your main site is `mycompany.com` then don't be surprised to see phishers sending `my-company.com` etc. Also, you can host our content on a separate domain while still having users visit the same domain.
joshdavham 10mo ago
Thanks for this comment tick_tock :) After reading this, I did some research and learned a lot. I never really considered that, by including many things under the same domain, that you're increasing your blast radius w.r.t security vulernabilites. Thanks for that
deleted 10mo ago
[deleted]
zahlman 10mo ago
But then you have to be able to trust that the other domain is actually operated by Discord and isn't some social engineering front.

__float 10mo ago

It's a bit surprising they did that, to be honest. I work at a similarly-sized, HN-popular tech company and our security team is very strict about less-trusted (third party!!) code running on another domain, or a subdomain at the very least, with strict CSP and similar. But in the age of AI, it seems like chasing the popular thing takes precedence to good practices.

staticassertion 10mo ago

This is what it really comes down to. Browsers are built around origins as the major security boundary. When you use a separate origin, safety comes for free.

mock-possum 10mo ago
Trust doesn’t though - discord.com/docs looks legit, as does docs.discord.com - discord-docs.com immediately sets off red flags
- brap 10mo ago
  Is there no way to tell the browser “hey this URL is using the same domain but please isolate it from the rest”?
  - staticassertion 10mo ago
    You can use a sandboxed iframe without an origin.
- staticassertion 10mo ago
  You can still have discord.com/docs with content hosted on discord-docs.com
integralid 10mo ago
And you open another can of worms which is phishing. If you run your marketing campaigns from yourcompany-deals-2025.com don't be surprised when people click yourcompany-login.com links
- staticassertion 10mo ago
  I'm not sure I understand. edit: That is, your phishing approach would work regardless, in my opinion. If your main site is `mycompany.com` then don't be surprised to see phishers sending `my-company.com` etc. Also, you can host our content on a separate domain while still having users visit the same domain.

joshdavham 10mo ago

Thanks for this comment tick_tock :) After reading this, I did some research and learned a lot. I never really considered that, by including many things under the same domain, that you're increasing your blast radius w.r.t security vulernabilites. Thanks for that

deleted 10mo ago

[deleted]

zahlman 10mo ago

But then you have to be able to trust that the other domain is actually operated by Discord and isn't some social engineering front.