Avoid using subdomains for accounts in your saas app

douglastarr.com

1 pointtarr114 comments

I think this misses a whole section on security.

e.g. https://security.stackexchange.com/questions/33851/protectin...

That's a great link, I will add it in. Thanks.

I think you're kind of missing my point. This space is a lot more complicated that the page indicates and the usual warning of "a little knowledge is a dangerous thing..." applies.

Some additional context:

- https://security.googleblog.com/2012/08/content-hosting-for-...

- https://en.wikipedia.org/wiki/Same-origin_policy

- and other articles on CORS, XSS and CSRF, etc

Is there some statement that I wrote that you believe is misleading or incorrect?

I'm trying to warn people off of subdomains, rather than encourage it.

Reply on news.ycombinator.com