Wrong terminology (TLD/SLD) in docs: /topics/security/

[chris@…]

/topics/security says about leveraging the same-origin policy:

One class of attacks can be prevented by always serving user uploaded content from a distinct Top Level Domain (TLD). This prevents any exploit blocked by same-origin policy protections such as cross site scripting. For example, if your site runs on example.com, you would want to serve uploaded content (the MEDIA_URL setting) from something like usercontent-example.com. It’s not sufficient to serve content from a subdomain like usercontent.example.com.

The term "Top Level Domain" is wrong and should be replaced by "second-level domain". In this example, the TLD is .com, but the example emphasizes the difference between "example.com" and "usercontent-example.com", which are different SLDs sharing the same TLD.

[chris@…]

Suggested wording.

[Sasha Romijn]

This is definitely a mistake, and something we should improve. The only thing I'm not sure about is the specific suggestion to have the Django app on example.com, and the user content on example.net. Although this will certainly work, it's a lot less obvious. In most cases, users who own both example.net and example.com would redirect one to the other. So this feels more error-prone. Perhaps we should leave the examples as they are currently.

[chris@…]

Suggested wording, update 1.

[chris@…]

Agreed, updated. I left the option of serving from a different top-level domain in, but reverted the addition of an example for that.

[Tim Graham <timograham@…>]

In f65eb15ac6807e3a44846be3cccc9bfc3e4b72cb:

Fixed #22504 -- Corrected domain terminology in security guide.

Thanks chris at chrullrich.net.

[Tim Graham <timograham@…>]

In c050ce7de2091f580bf85ab367d9c7f5cb26f44c:

[1.7.x] Fixed #22504 -- Corrected domain terminology in security guide.

Thanks chris at chrullrich.net.

Backport of f65eb15ac6 from master

[Tim Graham <timograham@…>]

In e9c78435ab9cfd27d0815c244c9a1feb08cc18d1:

[1.6.x] Fixed #22504 -- Corrected domain terminology in security guide.

Thanks chris at chrullrich.net.

Backport of f65eb15ac6 from master