1

I found most CDNs allow the user to claim any domains to be the backend, I wonder why they do this instead of verifying if the user owns the backend domain. If I have myowndomain.com and set the backend to be facebook.com, wouldn't it be an easier way to do attacks such as phishing? Of course, I still need to solve CORS, SOP, and Cookie related issues, but why do CDNs open the backend at the first place?

1

... why do CDNs open the backend at the first place?

Anyone can already setup their own domain without a CDN so that it works as a proxy to another domain. A simple hosting service or VPS is needed for this and sometimes even a simple CNAME will do. Thus if a CDN allows this it essentially makes only available what is possible otherwise too.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.