DISQUS

oobx · 2 months ago

I was just turned on to Coral and was pretty jazzed about it until I read your post. Google app engine as a CDN is what led me to Coral. GAE should not be subject to such security issues. I've not read your other posts; so please excuse my ignorance of firecoral, etc.

In trying to comprehend the scope of the security issues you raise, I conclude that only cookies set by nyud.net-cached content are vulnerable. So, I just use coral cache for images and truly static content.

But, what's to stop evildoer from linking to my script that sets cookies? Nothing. But, how would he gain the trust of the user in order for the user to click on the nyud.net link? Then, how would evildoer track that click and convince the user to go to the malicious site to hijack data?

Coral CDN sounds like a great asset for bandwidth-poor folks. I hope you can improve upon it. As is, it seems very workable so long as developers understand the caveats such as security and the potential to skew statistics.

Thanks for raising the issue.

Mike Freedman · 2 months ago

Hi oobx,

Actually, the cookie issue is much less a security issue if you are a website that is trying to explicitly use CoralCDN for cached content. You should just specify that your code uses the full origin name when setting cookies: www.yoursite.com.nyud.net, instead of just setting a default of the domain.tld (i.e., nyud.net) for "ease of use". This is good security practice anyway: the principle of least privilege and all. Then a user from evil.com.nyud.net can't read cookies set to www.yoursite.com.nyud.net, as it fails the same origin policy check.

The problem I raise above is more when a website is being accessed by a Coralized URL and they are not similarly security conscious, so that they default to using the domain.tld, instead of the full origin name.

Let me know if that assuages your concern.

trusts · 1 month ago

Do you think it's true that the internet is slated to run out of domain names next year?

Mike Freedman · 1 month ago

I'm not too worried about that. Much is just domain squatting anyway...

trusts · 1 month ago

Mike, that's a good point. I was listening to the radio last evening, and there is a group trying to do a .GAY top level domain. I thought it was interesting, because the person who is promoting that idea owns a for-profit business that plans on purchasing most of the popular domain names if .GAY gets the go ahead.

iphone clone · 1 week ago

Thanks for sharing~Please keep at your good work, I would come back often.*

itjobs555 · 1 week ago

well post.
For more jobs visit http://www.staffingpower.com