Make it crystal clear that you should not run Vector on the same domain as a HS

Question

Make it crystal clear that you should not run Vector on the same domain as a HS

ara4n opened this issue 8 years ago · 14 comments

ara4n commented 8 years ago

And instead your media repo at least should be on a different domain.

Answer 1 · 2016-08-17T08:12:21.000Z

Do we also want to add Content-Security-Policy: sandbox headers to responses from media repo?

Answer 2 · 2016-08-17T13:52:00.000Z

I'm interested why you shouldn't do that

Answer 3 · 2016-08-17T15:16:22.000Z

For the same reasons as https://developer.github.com/changes/2014-04-25-user-content-security. We'll ship an updated synapse very shortly (possibly today) with Erik's fix mentioned above to mitigate the risk.

Answer 4 · 2016-08-26T23:21:50.000Z

synapse 0.17.1 shipped with a mitigation for this.

Meanwhile I've pushed matrix-org/synapse@907486e and efc5462 to recommend that people put HSes on their own domain if at all possible.

Answer 5 · 2016-08-26T23:22:48.000Z

This was also mitigated a bit in vector in d3eccc1 ftr.

Answer 6 · 2016-09-04T11:44:44.000Z

Is this still something to be aware of:

I run Vector and Synapse on the same server. Both proxied through Nginx. Vector on vector.example.com matrix on matrix.example.com. Headers to prevent XSS active. Should I be physically separating matrix and vector, or are we saying complete full domain difference example1.com and example2.com?

Answer 7 · 2016-09-04T17:39:27.000Z

synapse 0.17.1 makes this much less of a concern, hence not pushing this issue. in general it's good practice to host on separate vhosts anyway, as you are doing. no need for physically separate hosts.

Answer 8 · 2017-01-28T20:54:01.000Z

What is best practice? It's not clear to me. “Much less of a concern” doesn't sound like not a concern at all.

Answer 9 · 2017-01-29T05:09:04.000Z

What is best practice? It's not clear to me. “Much less of a concern” doesn't sound like not a concern at all.

You are sharing cookies if you share a common root domain, so form submission logic is wacky. But as long as long as the sub-domains are different, the SOP is enforced correctly.

Answer 10 · 2017-01-29T08:35:22.000Z

Best practice is still to run Riot on a separate domain to the homeserver for good hygiene. However, we are not aware of any current attacks caused by sharing domain. We don't use cookies anywhere so form submission attacks aren't a major concern.

Answer 11 · 2019-06-01T19:47:22.000Z

Hello,

In this thread, you mention (from what I understand) that having Riot and Synapse served in matrix.domain.tld and riot.domain.tld doesn't bring security issues.
I was wondering if the same apply to Synapse serving in domain.tld and riot in riot.domain.tld, since Synapse is then in a parent domain.

Also, it's mentioned that it's better to run Synapse and Riot in different machines (wether physical or virtual).
What are the security implications of running Synapse and Riot on the same machine?

Thank you :)

Answer 12 · 2019-07-08T09:01:13.000Z

I am also interested whether this scenario is okay or not from a security standpoint. The whole domain/XSS part of the web is not exactly my strong suit, so I would also appreciate if you clarified this. Thank you :)

Answer 13 · 2021-01-26T21:46:56.000Z

Good evening,
I'm interested in installing a synapse server and the web element client.
I read this thread and I wonder if I install synapse on 1NDD.com and element on subdomain.1NND.com is it Ok or we really have to separate, if we can server on ndd1 and element on ndd2?
Thank you in advance for your details.
Kind regards.

Answer 14 · 2021-01-26T21:55:16.000Z

Please ask support questions like this in Matrix rooms like #element-web:matrix.org.