Re:GitHub Community Forum
by pronoiac on Tuesday November 14, 2017 @08:17AM
(#15694689)
My immediate thought is that they did this for browser security reasons, like how they use github.io for Github Pages.
[ Parent
| on HN ]
But isn't that governed by the same origin policy, which cares about specific hosts (so a subdomain would be equally effective)?
Subdomain can set a cookie for root domain [0] and that can lead to session fixation attacks. Cookies are not subject to CORS.
[0]: https://www.mxsasha.eu/blog/2014/03/04/definitive-guide-to-c...