Two domains, and why one would be cheaper
By João Saraiva
Solta is on two domains and pays for it every day. One would be simpler, cheaper and friendlier, and it would also mean that any site anyone published could read your session.
A published site is a file a stranger wrote. It runs in a browser, which means it runs JavaScript, which means it can do anything the browser lets the origin it is served from do. That last clause is the whole design.
What an origin is worth
Browsers do not defend files from each other. They defend origins from each other — the scheme, host and port together. Cookies, local storage and the ability to read another site's response all stop at that boundary, and inside it there is no boundary at all.
So if a site somebody published were served from the same host as the app they signed in to, it would sit inside the app's origin. Not near it. Inside it. Every cookie the session uses would be attached to its requests, and it could make those requests itself.
The sanitising road, briefly
The alternative is to strip what is dangerous out of the file. We tried to want this, because it is the version where everything lives on one domain and the whole product is smaller.
It does not survive contact with the actual job. The files people publish are dashboards and calculators and small applications; the script is the thing. Removing it leaves a screenshot. And sanitising HTML well enough to be a security boundary is a problem with a long public record of people losing.
What the split costs
Two certificates, one of them a wildcard, which cannot be issued by proving control of a single hostname and so needs a DNS token instead. Two sets of environment variables. Every link between the halves is cross-origin, so anything that has to cross carries a signed token with a short life and one job.
It also costs a small, permanent amount of confusion — the app is on one name and the sites it publishes are on another, and nobody arrives expecting that.
What it buys
A published site can be as hostile as its author likes and still reach nothing. It cannot read your cookies because they are not its cookies. It cannot call the API as you because the browser will not send your credentials to it. It cannot rewrite the page around it, because there is no site around it — the frame it lives in is a different origin.
And it means we can say yes by default. Uploads do not have to be inspected for hostility before they are allowed to run, because running is not the dangerous part. Where they run is.