17

My development server is on my local machine (127.0.0.1). I have created an A record in my DNS settings that points dev.mydomain.com to 127.0.0.1 so that I can use this domain name for accessing my local web app. I know I could use my /etc/hosts file but I feel it is easier to manage by using DNS and when we want to add a developer on the team, it removes the step of having to add a line in their hosts file.

My question is: is it safe to do this? Is there anything that can go wrong?

  • I used to do something similar, until I discovered Vagrant vagrantup.com – spuder May 26 '13 at 19:47
  • 3
    I also use Vagrant and I fail to see in what way Vagrant solves that problem since modifying the hosts file in the VM won't let the host machine use that domain. – Olivier Lalonde May 27 '13 at 17:35
9

Is it safe to do this?

I see no security problem with this.

Is there anything that can go wrong?

Possibly, though I am not sure I understood this correctly:
Has each developer their own development server and does each one work on their own local copy? Then this will work fine.

However if there is only one dev. server and you use this as your workstation then this might not work as expected since 127.0.0.1 is local host. As in each developers own localhost.

In ASCII graphics:

                                           Assigned IPs:
Your own computer                          127.0.0.1 
(with dev.server)         -----------      ::1
                                           'Normal' static or DHCP assigned IP


Other developers computer                  127.0.0.1
(Just a workstation)      -----------      ::1
                                           'Normal' static or DHCP assigned IP

If the other developer tries to access dev.mydomain.com then DNS will successfully translate that to 127.0.0.1. No need to add anything to the hosts file. But the other developer will not arrive at your dev. server. Localhost for him or her will be local.

|improve this answer|||||
  • 1
    > Has each developer their own development server and does each one work on their own local copy? Yes. – Olivier Lalonde May 26 '13 at 12:43
4

A relevant security issue is the "same site scripting" described here: http://www.securityfocus.com/archive/1/486606/30/0/threaded

Although this issue is pretty old, some websites still make this mistake recently: https://hackerone.com/reports/1509

|improve this answer|||||
  • Good answer, but please consider link rot. – Hennes Nov 7 '17 at 12:07
2

There is nothing security wise that would be a problem with this. It might block a valid domain name unless you are actually the owner of the domain, but it's a technique I've used for both development and sending ad servers DNS queries to invalid addresses.

As far as the potential side effects from a general networking standpoint, you'd probably want to ask on SuperUser or ServerFault.

|improve this answer|||||
0

(Not too sure the below is considered a security issue around here, but still:)

Five minutes ago, I was severely confused when visiting http://thesaurus.org/ and, out of the blue, looked at a website I had developed. Turns out, dig thesaurus.org at the time of writing points to 127.0.0.1, and I was looking at a website in my machine. From this experience:

A subdomain pointing to 127.0.0.1 could be an invitation for website spoofing. For example, if dev.microsoft.com points to localhost, links in e-mails etc. will appear to show a valid Microsoft website that is actually controlled by the attacker if:

  • The attacker is able to install a webserver on the user's machine, or to exploit software that provides this.

  • And if the user ignores the fact that there will be no SSL connection.

|improve this answer|||||
  • You are talking about a very different scenario. – schroeder Mar 30 at 22:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.