search

element-hq / element-web

A glossy Matrix collaboration client for the web.
https://element.io
GNU Affero General Public License v3.0
11.14k stars 1.99k forks source link

Make it crystal clear that you should not run Vector on the same domain as a HS #1977

Closed ara4n closed 8 years ago

ara4n commented 8 years ago

And instead your media repo at least should be on a different domain.

erikjohnston commented 8 years ago

Do we also want to add Content-Security-Policy: sandbox headers to responses from media repo?

azrdev commented 8 years ago

I'm interested why you shouldn't do that

ara4n commented 8 years ago

For the same reasons as https://developer.github.com/changes/2014-04-25-user-content-security. We'll ship an updated synapse very shortly (possibly today) with Erik's fix mentioned above to mitigate the risk.

ara4n commented 8 years ago

synapse 0.17.1 shipped with a mitigation for this.

Meanwhile I've pushed matrix-org/synapse@907486e and efc5462 to recommend that people put HSes on their own domain if at all possible.

ara4n commented 8 years ago

This was also mitigated a bit in vector in https://github.com/vector-im/vector-web/commit/d3eccc1d6f7f3e19a39df41f9658d056a7feff04 ftr.

anatomism commented 8 years ago

Is this still something to be aware of:

I run Vector and Synapse on the same server. Both proxied through Nginx. Vector on vector.example.com matrix on matrix.example.com. Headers to prevent XSS active. Should I be physically separating matrix and vector, or are we saying complete full domain difference example1.com and example2.com?

ara4n commented 8 years ago

synapse 0.17.1 makes this much less of a concern, hence not pushing this issue. in general it's good practice to host on separate vhosts anyway, as you are doing. no need for physically separate hosts.

jooize commented 7 years ago

What is best practice? It's not clear to me. “Much less of a concern” doesn't sound like not a concern at all.

indolering commented 7 years ago

What is best practice? It's not clear to me. “Much less of a concern” doesn't sound like not a concern at all.

You are sharing cookies if you share a common root domain, so form submission logic is wacky. But as long as long as the sub-domains are different, the SOP is enforced correctly.

ara4n commented 7 years ago

Best practice is still to run Riot on a separate domain to the homeserver for good hygiene. However, we are not aware of any current attacks caused by sharing domain.

We don't use cookies anywhere so form submission attacks aren't a major concern.

eauchat commented 5 years ago

Hello,

In this thread, you mention (from what I understand) that having Riot and Synapse served in matrix.domain.tld and riot.domain.tld doesn't bring security issues. I was wondering if the same apply to Synapse serving in domain.tld and riot in riot.domain.tld, since Synapse is then in a parent domain.

Also, it's mentioned that it's better to run Synapse and Riot in different machines (wether physical or virtual). What are the security implications of running Synapse and Riot on the same machine?

Thank you :)

fridtjof commented 5 years ago

I am also interested whether this scenario is okay or not from a security standpoint. The whole domain/XSS part of the web is not exactly my strong suit, so I would also appreciate if you clarified this. Thank you :)

fdrubigny commented 3 years ago

Good evening, I'm interested in installing a synapse server and the web element client. I read this thread and I wonder if I install synapse on 1NDD.com and element on subdomain.1NND.com is it Ok or we really have to separate, if we can server on ndd1 and element on ndd2? Thank you in advance for your details. Kind regards.

jryans commented 3 years ago

Please ask support questions like this in Matrix rooms like #element-web:matrix.org.