Edge Security and DNS Hardening for Multi-Tenant Systems
Key technical considerations when provisioning public user-facing subdomains: HSTS preloading, DNSSEC, and malicious payload sanitization.
Allowing dynamic subdomain creation comes with inherent security risks if inputs are not strictly validated at the perimeter. Attackers often attempt path traversal, header injection, or domain spoofing through subdomains.
The first line of defense is strict RFC 1123 character enforcement: tenant slugs must only contain lowercase alphanumeric characters and hyphens, strictly between 3 and 63 characters long, never starting or ending with a hyphen.
Second is reserved namespace collision protection. Critical system routes—including api, admin, mail, ftp, cdn, staging, and static—must be permanently blacklisted from tenant registration.
Lastly, strict Content Security Policy (CSP), HTTP Strict Transport Security (HSTS) with includeSubDomains, and X-Content-Type-Options: nosniff ensure that tenant-rendered content cannot compromise the parent origin domain.