secure subdomains: increase security

[nick1udwig]

Problem

Secure subdomain can be circumvented by the user manually navigating to that subdomain and then entering another apps endpoint. E.g., imagine there is a good:good:foo.os app and a evil:evil:bar.os app. good has a secure subdomain. Then the user can manually navigate to

good-foo-os.example.com/evil:evil:bar.os

and then evil can access goods api.

This exposes users to accidents and malicious apps/users ("just navigate to this link and it'll work").

Solution

Don't allow secure subdomains to be used for any but their matching endpoint.

Testing

test-secure-subdomain.tar.gz

good and evil, above, both serve uis. Try to access goods API via evil. On main it works; here it does not.

Docs Update

None

Notes

None