5

I have seen a trend of applications moving their APIs to other domains (from api.application.com to api.applicationapi.com).

Two examples: 3.basecampapi.com and api.dropboxapi.com

Is there a security benefit to host the API in a different domain than the dashboard or marketing website? Why does a subdomain is not enough?

5

Is there a security benefit to host the API in a different domain than the dashboard or marketing website?

In a word, resilience.

One benefit is that any security blocks which are put in place due to content on the dashboard or marketing website will not impact the API, if the API is on a completely different domain.

(If "marketing" means Wordpress or Drupal, for example, such blocks can be a very real threat!)

I've had direct experience with blocks triggered by the Google Blacklist, and they can impact the domain name and subdomains thereof. If example.com ends up with malware on it, then api.example.com (and api.api.example.com) will get blocked as well.

Moving to api.exampleapi.com cleanly segregates the API so it won't be impacted if example.com is blacklisted.

Why does a subdomain is not enough?

Again, with Google at least, blocks may extend into subdomains as well. Also, DNS-based filters like OpenDNS wildcards will block all subdomains as well.

  • 1
    Why do you care about API domain being listed (or not blacklisted) on Google? – Vladimir Prudnikov Dec 20 '18 at 14:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.