Element-web: Is installing riot in subdomain of the domain used by synapse a problem?

[eauchat]

In this issue it's explained that you shouldn't run riot with the same domain where synapse is running. I posted this question to get details about it but never got any comment on that, so I thought maybe I can create a proper issue for this question.

The thread mentions (from what I understand) that having Riot and Synapse served in matrix.domain.tld and riot.domain.tld doesn't bring security issues.
I was wondering if the same apply to Synapse serving in domain.tld and riot in riot.domain.tld, since Synapse is then in a parent domain.

Also, it's mentioned that it's better to run Synapse and Riot in different machines (whether physical or virtual).
What are the security implications of running Synapse and Riot on the same machine?

Thanks a lot for the attention :)

[t3chguy]

This is more a support question for #riot:matrix.org which is why it never got attention on an already closed issue.

[eauchat]

I could ask it on #riot:matrix.org yep. I asked here because seeing the reactions on my previous comment, it seemed that other people were interested as well.
So I thought it'd be useful to have the answer more widely accessible.

[turt2live]

Subdomains are different domains as far as CORS is concerned, however do be cautious about running your homeserver on example.org and riot on riot.example.org

[eauchat]

Thank you for the precision @turt2live.
Any further precision on what means "being cautious" and what are the risks is still very welcome :)

[turt2live]

You theoretically can open yourself up to XSS and similar attacks if using the same domain. It's generally considered a very bad practice.

[Josue-T]

Hello,

And how about this follow configurations:

• Riot installed on riot.domain_1.tld.
• Synapse installed on synapse.domain_1.tld.
• And the username for this synapse instance is user#domain_1.tld. With this following dns registry:

_matrix._tcp.domain_1.tld     3600    IN SRV   10   0   8448   synapse.domain.tld

[turt2live]

@Josue-T this is not the place to verify your configuration. Please visit #riot-web:matrix.org or #synapse:matrix.org instead.

[eauchat]

I find @Josue-T's question useful and still feel not so clear about this issue.