I'm writing an application (example.com) that gives users their own sub-domains to run arbitrary user applications off of (user.example.com).

Each user application will be run on separate servers with distinct domains, and my application will route user.example.com to users-app.com.

Are my users able to compromise each other? What about the parent domain example.com?

  • 4
    The browser doesn't know or care whether they are on separate servers. Read on the rules for same origin policy and about cookies on Mozilla developer network site. – Z.T. Jun 23 at 12:21
  • 1
    Note that the CMS/admin interface that edits the sites should be on a separate domain than the edited sites. Like blogger.com edits blogspot.com sites. – Z.T. Jun 23 at 18:56
  • @Z.T. Thanks! I looked at the same-origin policy and was wondering if there are still problems if example.com is not in use? According to this, sub-domains are treated as different origins. If example.com is not in use, and users scope their domains to user.example.com, what other security concerns should I be war of? – sahil Jun 24 at 0:24
  • If example.com is unused, that would work, I think. But on which domain would you have the application that gives users their own sub-domains, if not on example.com? Personally I would place the admin/CMS on a separate domain. – Z.T. Jun 24 at 0:32

Quick answer: Probably yes

Domain and sub-domain names are just pointers to where your application resides, or at least, where it can be reached if you've put additional proxies in place.

So the real question is what stops anyone compromising any of your users at the application level?

There are plenty of exploits and developer errors to get around what browsers should enforce when communication with hosts, and attackers can always go after your servers directly.

So yes, if you screw up your application design or implementation badly enough, using sub-domains isn't going to magically save you. I would also suspect dedicated servers per customer isn't going to scale too well either, but that's a different issue.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.