Take the 2-minute tour ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

A company I've been developing a web site for wants to keep their current domain, which is something like company.parentcompany.com. Because we wanted to use a different CMS, the parent company refused to support or even host it and asked us to pay for third-party hosting.

Now that we've done that, they won't make an A record for the subdomain pointing at the new server, stating that it is a security risk. I'm not a DNS expert by any means, but this sounds like total BS to me. I've seen this discussed several times, but I've never seen anyone raise security issues.

Can I fight this, or are they really correct?

share|improve this question

migrated from stackoverflow.com Apr 15 '11 at 0:01

This question came from our site for professional and enthusiast programmers.

1 Answer 1

up vote 6 down vote accepted

Different subdomains can share cookies (depends on the cookie path used), and thus the third party could steal cookies used to authenticate on the main domain. This is also the case if your CMS gets hacked.

You could get a new domain for your new website and setup a redirect on your old domain. That should take care of most security issues.

There might also be some issues regarding cross site scripting. I think your externally hosted website might be allowed to make requests to the parent site with the parent site's cookies. But I've never tried it, so I don't know if the browsers send the .parentsite cookies in that case too.

share|improve this answer
    
As far as I can tell, any cookies from the parent site have the domain .parentcompany.com (and path /), and any services that require authentication seem to be on separate subdomains anyway (as I understand it, this type of attack only applies to the parent domain, not other subdomains?). Since this is dependent on how the parent domain generates cookies, doesn't this put the burden on them to have secure cookies? –  Will Apr 14 '11 at 18:59
    
Not sure about that. There might be other ways in which different subdomains are considered part of the same trust zone. –  CodeInChaos Apr 14 '11 at 19:13
    
Ok. Thanks for your insight. I guess we'll have to pay for our own domain, too. Normally I wouldn't be so insistent about using the subdomain, but the "parent company" is charging $30 per month (as a "consulting fee"!) just for the subdomain!!! And now all they're doing is redirecting it! –  Will Apr 14 '11 at 19:47

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.