13

A company I've been developing a web site for wants to keep their current domain, which is something like company.parentcompany.com. Because we wanted to use a different CMS, the parent company refused to support or even host it and asked us to pay for third-party hosting.

Now that we've done that, they won't make an A record for the subdomain pointing at the new server, stating that it is a security risk. I'm not a DNS expert by any means, but this sounds like total BS to me. I've seen this discussed several times, but I've never seen anyone raise security issues.

Can I fight this, or are they really correct?

Improve this question

1 Answer 1

Reset to default
6

Different subdomains can share cookies (depends on the cookie path used), and thus the third party could steal cookies used to authenticate on the main domain. This is also the case if your CMS gets hacked.

You could get a new domain for your new website and setup a redirect on your old domain. That should take care of most security issues.

There might also be some issues regarding cross site scripting. I think your externally hosted website might be allowed to make requests to the parent site with the parent site's cookies. But I've never tried it, so I don't know if the browsers send the .parentsite cookies in that case too.

Improve this answer
3
  • As far as I can tell, any cookies from the parent site have the domain .parentcompany.com (and path /), and any services that require authentication seem to be on separate subdomains anyway (as I understand it, this type of attack only applies to the parent domain, not other subdomains?). Since this is dependent on how the parent domain generates cookies, doesn't this put the burden on them to have secure cookies?
    – Will
    Commented Apr 14, 2011 at 18:59
  • Not sure about that. There might be other ways in which different subdomains are considered part of the same trust zone.
    – CodeInChaos
    Commented Apr 14, 2011 at 19:13
  • Ok. Thanks for your insight. I guess we'll have to pay for our own domain, too. Normally I wouldn't be so insistent about using the subdomain, but the "parent company" is charging $30 per month (as a "consulting fee"!) just for the subdomain!!! And now all they're doing is redirecting it!
    – Will
    Commented Apr 14, 2011 at 19:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.