PSA: Always use a separate domain for user content

Re:PSA: Always use a separate domain for user content by ericselin on Friday October 10, 2025 @10:45AM (#45539680)

The thing is, you cannot just add any domain to the PSL. You need a significant amount of users before they will include your domain. Before recently, there really was no point in even submitting, since the domain would have been rejected as too small. An increase in user base, increase in malicious content and the ability to add your domain to the PSL all happen sort of simultaneously.

I'm also trusting my users to not expose their cookies for the whole *.statichost.eu domain. And all "production" sites use a custom domain anyway, which avoids all of this anyway.

[ Parent | on HN ]

Re:PSA: Always use a separate domain for user content by neon_erosion on Friday October 10, 2025 @11:07AM (#45539916)

There are well-documented solutions to this that don't rely on the PSL. Choosing to ignore all of that advice while hosting user content is a very irresponsible choice, at best.

[ Parent | on HN ]

Re:PSA: Always use a separate domain for user content by ericselin on Friday October 10, 2025 @02:22PM (#45542121)

So the problem here is that Alice on alice.statichost.page might set a cookie for the `.statichost.page` domain if she's careless (which is sometimes the case with Alice). This cookie can then be read by Mallory on mallory.statichost.eu. Or the other way around, if Mallory wants to try to trick Alice into reading his cookie. How this can be prevented without the PSL is something I'm very interested to hear more about.

[ Parent | on HN ]