Open sylvinus opened 8 years ago
You can't restrict based on domain because rel="canonical"
is used for attribution across sites. For example, I regularly post things on my own personal blog and my employer's blog. They don't pay me for blog posts, so I have them insert a rel="canonical"
link.
Currently we force canonical URLs declared in the meta tags to be on the same domain as the base document: https://github.com/commonsearch/cosr-back/blob/master/cosrlib/document/html/htmldocument.py#L346
Is this requirement too strict? If we relax it (same root domain? same DNS owner? any domain?), would some abuse/impersonation be possible?