Protect what matters – even after you're gone. Make a plan for your digital legacy today.
Forum Discussion
cjkochis
3 years agoNew Contributor
Support for Vercel preview links
We host our site on Vercel, and leverage their preview links for development and QA. These links are generated for each new feature our team is working on, and have a format similar to:
https://<...
Former Member
3 years agoI suspect this is because .vercel.app is on the "eTLD" list https://publicsuffix.org/list/public_suffix_list.dat. That means the domain .vercel.app is effectively a top-level domain (like .com or .org). This is relevant for security because it means that anyone can host something on a subdomain.
For example, browsers use this list for cookie security and I suspect 1password is also using this list to see if two domains can be considered related. E.g.:
- If you have a password for a.google.com, you should also be able to use it on b.google.com.
- But if you have a password for a.uk.org, you should not be able to use it on b.uk.org.
.com, .uk.org and .vercel.app are all considered effective top-level domains (eTLD). And only if the domain one down from the eTLD (so-called eTLD+1) is the same, the domains should be considered related.
That being said, it is extremely annoying: Vercel is a service for developers, the Vercel preview environments on .vercel.app are only used to preview websites, and Vercel is constantly generating new Preview environments with defacto random names.
If I save a login for a preview (.vercel.app) URL, I will almost always want to use it on another preview domain. And the chances of someone tricking me into filling the password into a preview environment from someone else are relatively small.
Please make an expectation for .vercel.app. Yes, it should be on the eTLD list but no IMO 1Password should not treat it like other eTLDs.