Web Security · Senior · Question 28 of 75
Why do security teams serve user-uploaded content from a separate domain like usercontent.example?
- ✓Correct answer: Anything that runs there is a different site, so it can't read your cookies, storage or same-site APIs
- 2Because it's cheaper to host
- 3Because browsers refuse to show uploads from the main domain
Explanation
A separate registrable domain (not a subdomain) avoids same-site cookie sharing too. Large platforms use this sandbox domain approach.