Take the 2-minute tour ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

So, for a multi user web app, what is better:

http://username.domain.com

Or

http://domain.com/username

I would like to get feedback about security, scalability and maintenance specifically, app is php based, so it is .htaccess based for url rewriting.

share|improve this question

migrated from stackoverflow.com May 23 '11 at 1:07

This question came from our site for professional and enthusiast programmers.

1  
    
You don't even have a question here –  random May 23 '11 at 1:06

3 Answers 3

up vote 2 down vote accepted

As with any high level question such as this one, the answer will largely depend on your requirements.

The first question I should ask though (since it was not specified in your question) is why are you concerned with a subdomain or subfolder at all? Will these be for "vanity" URLs? If not and you are only serving up content based on a user logging in, then you would only need your base URL (no need for a folder or subdomain). Once you authenticate a user, you will know who they are and what they should have access to and can serve up content based on their login.

If you are looking to use this for vanity URLs, then here are a few pros/cons of each:

Subfolders

  • Better option for SEO. Search engines will see each subdomain as a separate website and will not give as much weight to the root domain. Using subfolders will help to improve SEO rankings.
  • Your code will most likely have some kind of rewrite involved if you are planning to only have a single code base.
  • Will still need to take into account what a user is allowed to see based on their login.
  • As JamesRyan mentioned, if users are generating any code, then cookies could be a concern since they are all on the same domain.
  • If you are planning to use SSL (which you should be if you have users providing passwords or other private data), then you would only need a single certificate. You can use a single wildcard certificate for subdomains, but those tend to be much more expensive.

Subdomains

  • Better option if you are looking to create separate web sites (i.e. different webroot, different apache instance, different ssl certificate for each site, etc.)
  • Wouldn't necessarily have any rewrites to take into account (although you still could). Your code could be written to check the host header to determine what content to serve up.
  • Would require either a wildcard DNS record or you will need to manually create DNS records for each subdomain you create. Depending on the number of subdomains being created, this could require a lot of effort. Wildcard DNS records would for sure be the way to go.
  • As with the subfolder option, if you are using the same code base to serve up each site, you still need to authenticate users and check what they are authorized to see.

At the end of the day, it really comes down to what your requirements are. I've only listed a few things to keep in mind with either option. If you would like to refine your question to be more specific I'm sure you would probably get a few more specific answers.

share|improve this answer

Using folders is definitely, definitely, definitely easier to manage and much more scalable.

For subdomains, you have to create a new server-instance for each one. With folders, you just make a new folder.

Subdomains win on security, but if the content on the profile in managed, then you should go with folders.

If it's something that users have complete control over, then use subdomains.

share|improve this answer
1  
not at all. You can create a single wildcard instance and then return appropriate content based on the domain almost identically to the way you would treat subfolders programatically –  JamesRyan May 23 '11 at 12:21
    
@JamesRyan Good to know. –  tylermwashburn May 23 '11 at 23:42

Cookies apply to domains so would be shared if you used folders but with subdomains could apply to the whole domain or individual sub domains.

If you host user generated content you would need to be careful to avoid XSS attacks.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.