Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Lets say that I have a web application, built in Django and deployed with Nginx.

Is it a good idea to offer a service that allows customers to request that a subdomain can be pointed at it.

I figured this:

If I dont allow this, then some companies wont want to access the service from

http://mydjangoappmadeupname.com/bigcorporation/

They would rather access it through

http://service.bigcorporation.com

That would effectively mask that they are using an outside resource.

Is there a significant risk that I am overlooking? Also do you think it would be easier to just set things up in Django to handle it, allowing Nginx to accept all domains and then pushing them to Django which would filter out if they are allowed or not, or would it be better to just update my Nginx log each time a client wanted this changed?

share|improve this question

2 Answers 2

up vote 1 down vote accepted

Regarding the DNS part, there's no way you can prevent that. I can happily make CNAME records that will point to google.com, microsoft.com, mydjangoappmadeupname.com or any other name that comes to my mind.

If it is indeed a security risk it's just that way because you grant more rights to one name than another.

Regarding the application part, I'd definitely handle that in code rather than server configuration. The application can happily request domain names from a database and do certain stuff depending upon that (change css, login handler, whatever). It would be quite a maintenance nightmare to do that with server configuration.

Besides: Let the server do it's server stuff (that means, tune it for the workload you have, in the apache case those would be mpm settings, max. request size and somesuch). Let the application the stuff it knows best about. That means a plain http server has no idea wether example.com pays for having a custom css and example.net doesn't pay.

The risk is just that you introduce bugs in you application. But I can't see how you'd set up more complex requirements than "react to these domains" in the http server

share|improve this answer
    
Thank you, I was more thinking you could prevent domains in Nginx by not supplying a default thereby giving requests from unauthorized domains a 502 response. –  DantheMan Jun 21 '11 at 23:58
    
I'm pretty sure you could. But that would still make the CNAME point to your server, you can do all sorts of stuff on your side. But my nameserver is nothing you have control over –  Server Horror Jun 22 '11 at 0:30

I believe you can totally do this sort of thing safely. Granted, is it a security risk? Probably - so is existing at all. I just think of Tumblr and Posterous as examples where this sort of functionality seems very much available.

Personally, I like the idea of handling the logic for this in your web application itself. I'd think that'd help you navigate overlooking security holes through your web server config and could swap in different web servers easier, if you ever wanted to... Or you could migrate your site easier at least. Seems like something you should be able to handle easily enough through Django's urls.py files.

This said, I'm not an info sec guy. Still, sounds sane to me. I don't think it's common practice only because I get the sense that most people are really confused about how they can use DNS.

Something you'd lose by having the domains managed outside of the server is with respect to ssl certs. But I think in your case you could just have a wildcard cert and it wouldn't matter anyway. Granted, I think wildcard certs are kind of pricey.

My thoughts anyway.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.