News for hackers. Stuff that matters.

A comment on Userdir URLs like https://example.org/~username/ are dangerous. Parent comment

Re:Userdir URLs like https://example.org/~username/ are dang... by k1t on Tuesday April 07, 2020 @09:35PM (#22809289)
If you own example.com and want to have cookies accessible in the root (e.g. example.com/login.html) then you can't prevent example.com/users/~evildoer from accessing them.
[ Parent | on HN ]
Re:Userdir URLs like https://example.org/~username/ are dang... by squiggleblaz on Wednesday April 08, 2020 @05:11AM (#22811281)
Don't we have equivalent problems with evildoer.example.com trying to get and set example.com cookies? Hence why Google and Github and other major sites use separate domain for user hosted content vs first party content.

Cookies are a terrible security model in general.

[ Parent | on HN ]
Re:Userdir URLs like https://example.org/~username/ are dang... by budgi4 on Tuesday April 07, 2020 @09:48PM (#22809343)
No, but you could redirect your root requests to example.com/home and serve from there with relevant cookies restricted to the /home path.
[ Parent | on HN ]