title: Subdomain security in Rails
body: <p>Let's say I'm trying to create an application called Blue. Blue is a Ruby on Rails application that turns the background of any website blue. It also allows users to log in and keep track of the websites they've visited and turned blue.</p>
  
  <p>In order to turn a website's background websites blue, I've created a web proxy that inserts <code>&lt;link HREF="http://www.example.com/blue.css" type="text/css"&gt;</code> into the response's body. The proxy is implemented as a rack application and is be placed inside the Rails routes using the approach from the <a href="http://railscasts.com/episodes/222-rack-in-rails-3?view=asciicast" rel="nofollow">Rack in Rails 3 Railscast</a>:</p>
  
  <pre><code>root :to =&gt; BlueProxy, :constraints =&gt; { :subdomain =&gt; "proxy" }
  </code></pre>
  
  <p>I'm very concerned about security with this approach. I know by default the domain for the cookies in my application would be <code>.example.com</code>. If the user typed in a malicious URL, the website could manipulate the user's account. I could fix this by only allowing the <code>www</code> subdomain for cookies in the application. However, I'd also like the proxy to be able to store cookies for the proxied site as well.</p>
  
  <p>Here are my three questions:</p>
  
  <ol>
  <li>Is this a bad approach? Is there a better way to solve this problem?</li>
  <li>What's the best way to keep sibling subdomain cookies separate in Rails?</li>
  <li>Are there any other security concerns I'm missing?</li>
  </ol>