Hacker News Reader

I've never seen a userdir URL being used with anything but raw static HTML with no or little JS. Generally the type of people who use these hosts don't use cookies or local storage at all. They just want to post a few web pages, photos, or documents. Can someone find an example?

View on HN

Eighteen years ago my university let me host PHP scripts in a /~user directory, and I wrote my own simple blogging software and ran it there.

It was vulnerable to the attacks described here. Thankfully no-one on that domain ever exploited it in that way.

Today my college lets me do the same. I wonder if I could even possibly use `mod_wsgi` to run something like a Python server.

Most userdir hosting allows you to run CGI, PHP and whatever other scripting supported by Apache. Stuff that required a persistent connection to the server (I.e. WSGI) usually isn't supported... almost every cPanel host out there is set up in this manner... Unfortunately the path part of a URL is not used for same origin, so the security issue being floated is real for myhost.com/~someuser.

Reply on news.ycombinator.com