Make it crystal clear that you should not run Vector on the same domain as a HS

[ara4n]

And instead your media repo at least should be on a different domain.

[erikjohnston]

Do we also want to add Content-Security-Policy: sandbox headers to responses from media repo?

[azrdev]

I'm interested why you shouldn't do that

[ara4n]

For the same reasons as https://developer.github.com/changes/2014-04-25-user-content-security. We'll ship an updated synapse very shortly (possibly today) with Erik's fix mentioned above to mitigate the risk.

[ara4n]

synapse 0.17.1 shipped with a mitigation for this.

Meanwhile I've pushed matrix-org/synapse@907486e and efc5462 to recommend that people put HSes on their own domain if at all possible.

[ara4n]

This was also mitigated a bit in vector in d3eccc1 ftr.

[anatomism]

Is this still something to be aware of:

I run Vector and Synapse on the same server. Both proxied through Nginx. Vector on vector.example.com matrix on matrix.example.com. Headers to prevent XSS active. Should I be physically separating matrix and vector, or are we saying complete full domain difference example1.com and example2.com?

[ara4n]

synapse 0.17.1 makes this much less of a concern, hence not pushing this issue. in general it's good practice to host on separate vhosts anyway, as you are doing. no need for physically separate hosts.

[jooize]

What is best practice? It's not clear to me. “Much less of a concern” doesn't sound like not a concern at all.

[indolering]

What is best practice? It's not clear to me. “Much less of a concern” doesn't sound like not a concern at all.

You are sharing cookies if you share a common root domain, so form submission logic is wacky. But as long as long as the sub-domains are different, the SOP is enforced correctly.