Running blog under /blog, security considerations

This post has been de-listed

It is no longer included in search results and normal feeds (front page, hot posts, subreddit posts, etc). It remains visible only via the author's post history.

Post Flair (click to view more posts with a particular flair)

Analysis

Post Body

I'd like to set up a self-hosted Ghost.org blog for a SaaS. I have two options: - example.com/blog - blog.example.com

Everywhere I read they recommend the /blog for SEO. However, I'm concerned about the security considerations of such setup.

First, the cookies. Do I have to worry about them?

The existing cookies for the SaaS have: - domain specified - path as / - HttpOnly - Secure - SameSite: Lax

Is there any chance that Ghost.org blog at /blog can potentially access or modify the SaaS app's cookies?

My other concern is if someone is able to upload anything into blog. It's not supposed to happen, but there is a member interface for Subscribe/Unsubscribe on Ghost.org, which means that theoretically they could find a way to upload some file. If not today, then maybe in the future.

Anything else I need to be concerned about in the /blog scenario?

Author

Account Strength

80%

Account Age

9 years

Verified Email

Yes

Verified Flair

Total Karma

454

Link Karma

352

Comment Karma

102

Profile updated: 1 day ago

hyperknot

Subreddit

r/AskNetsec

Post Details

We try to extract some basic information from the post title. This is not always successful or accurate, please use your best judgement and compare these values to the post title and body for confirmation.

Posted: 6 months ago
Reddit URL: View post on reddit.com
External URL: reddit.com/r/AskNetsec/c...