If I provide a public-facing website for users on my website at their own subdomain (e.g.
myapp.com)? The users would be able to put their own
*.js files in the public root of their subdomains.
I have an extremely limited understanding of the JS Same Origin Policy, but I believe that different subdomains count as different origins. Therefore if my main app (
myapp.com) is secured from XSS etc., is there anything specific I need to worry about from the users' subdomains that I wouldn't have to worry about for any other external source?