It's a good idea to host user-uploaded files on a completely separate domain, since older browsers are terrible at security: http://googleonlinesecurity.blogspo

It's a good idea to host user-uploaded files on a completely separate domain, since older browsers are terrible at security: http://googleonlinesecurity.blogspot.com/2012/08/content-hosting-for-modern-web.html http://googleonlinesecurity.blogspot.com/2012/08/content-hos... For example, it's possible to construct a perfectly valid image file, served with the correct image/gif MIME type that contains malicious a Javascript payload, and older versions of Internet Explorer might still execute that Javascript. If it is served from your web apps main domain or a subdomain, then this Javascript can access users' sessions.