Implications on automatically "open" third party domain aliasing to one of my subdomains

Question

I have a domain, let's call it www.mydomain.com where I have a portal with an active community of users.

In this portal users cooperate in a wiki way to build some "kind of software". These software applications can then be run by accessing "public.mydomain.com/softwarename"

I then want to let my users run these applications from their own subdomains. I know I can do that by automatically modifying the.htaccess file. This is not a problem.

I want to let these users create dns aliases to let them access one specific subdomain. So if a user "pippo" that owns "www.pippo.com" wants to run software HelloWorld from his own subdomains he has to:

1. Register to my site
2. Create his own subdomain on his own site, run.pippo.com
3. From his DNS control panel, he creates a CNAME record "run.pippo.com" pointing to "public.mydomain.com"
4. He types in a browser http://run.pippo.com/HelloWorld

When the software(that is physically run on my server) is called, first it checks that the originating domain is a trusted one. I don't do any other kind of check that restricts software execution.

From a SEO perspective, I care about Google indexing of www.mydomain.com but I don't care about indexing of public.mydomain.com

What are the possible security implications of doing this for my site?

Do you know some existing website implementing a domain configuration like this one?

Answer 1

From an SEO point of view you shouldn't have any issues unless there is malware in any of those applications. If someone puts some kind of malware in their code Google may flag your site as unsafe and then anyone seeing your domain in the search results or try to view it in Chrome will see a nasty message telling them your site is unsafe and recommending not visiting it.

As far as security goes, since the code isn't actually residing on your server you should be safe from malicious code in those applications.

Answer 2

If you are currently using www.example.com for yourself and giving users username.example.com, then additionally allowing users to create username.com as an alias of username.example.com doesn't really change much.

That said, especially in the case of www.example.com / username.example.com I would take care to keep the subdomains clean in regards to webspam, phishing, and malware. If, for instance, a significant number of subdomains are known to contain malware, then the automated systems behind the malware analysis may assume that the whole domain potentially contains malware.