允许客户端在 Web 应用程序中支持 CNAME/DNS 屏蔽有哪些潜在问题？
我们公司开发了其他公司可以授权的网络应用程序。通常，我们的应用程序运行在：
www.company.example
客户端版本的应用程序运行在：
client.company.example
通常，客户端运行自己的站点位于：
www.client.example
有时，客户请求从以下位置获取其应用程序版本：
application.client.example
这种设置常见于博客 ( Wordpress、Blogger、Kickapps）。
从技术上讲，使用 CNAME/A 记录和一些应用程序配置实现这种“DNS 屏蔽”非常简单。然而，我已经考虑到了与此相关的一些潜在问题，并且想知道您是否能想到我错过的任何其他问题：
1）流量统计（由外部提供商衡量，例如竞争.com）将会较低，因为 company.example 的流量不包括 application.client.example 的流量。 （当然，本地统计数据不会受到影响）
2) 从 application.client.example 到 company.example 潜在的 cookie 泄露。如果客户端在 .client.example 设置 cookie，则这些 cookie 可以由 company.example 服务器读取。
3) 电子邮件欺骗。 电子邮件可能是从带有 application.client.example 域的 company.example 发送的，可能会因 SPF 记录不兼容而导致垃圾邮件黑名单问题。
感谢您对此的任何想法。
Our company develops a web application that other companies can license. Typically, our application runs on:
www.company.example
And a client's version of the application is run on:
client.company.example
Usually, a client runs their own site at:
www.client.example
Sometimes, clients request to have their version of the application available from:
application.client.example
This kind of setup is often seen with blogs (Wordpress, Blogger, Kickapps).
Technically, achieving this "DNS Masking" with a CNAME/A Record and some application configuration is straightforward. I've thought out some potential issues related to this, however, and wonder if you can think of any others that I've missed:
1) Traffic statistics (as measured by external providers, e.g., compete.com) will be lower since the traffic for company.example won't include that of application.client.example. (Local stats would not be affected, of course)
2) Potential cookie disclosure from application.client.example to company.example. If the client is setting cookies at .client.example, those cookies could be read by the company.example server.
3) Email Spoofing. Email could be sent from company.example with the domain application.client.example, possibly causing problems with spam blacklisting due to incompatible SPF records.
Thanks for any thoughts on this.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
CNAME 已被广泛使用很长时间，尤其是托管公司。没有什么大问题。
对我们来说最大的问题是何时必须使用 HTTPS。在同一台服务器上支持多个 CNAME 是非常困难的。我们在证书中使用别名（SAN 扩展）。每次在 DNS 中添加新的 CNAME 时，我们都必须获取新的证书。除此之外，一切对我们来说都很好。
至于你提到的问题，
CNAME has been widely used for so long, especially by hosting companies. There are no major issues.
The biggest problem for us is when you have to use HTTPS. It's very difficult to support multiple CNAMEs on the same server. We use aliases in certificate (SAN extension). We have to get a new cert every time a new CNAME is added in DNS. Other than that, everything works great for us.
As to the issues you mentioned,