Public suffix boundaries: are browser isolation controls keeping up?

TL;DR: The Public Suffix List still underpins browser cookie boundaries and tenant isolation across multi-tenant services, but ngrok’s analysis shows volunteer maintainers are facing record submission pressure and growing disagreement over how hard the list should be to join. That makes trust boundaries a governance problem, not just a browser detail.

Editorial analysis by NHI Mgmt Group, based on content published by ngrok: “What the heck is the Public Suffix List?”.

Key questions

Q: What breaks when tenant isolation depends on browser cookie boundaries?

A: When tenant isolation depends on browser cookie boundaries, a mis-scoped cookie can cross from one application into another and expose a session to the wrong tenant.

Q: Why do shared subdomains create security risk in multi-tenant platforms?

A: Shared subdomains create security risk because browsers cannot infer organisational trust from DNS labels alone.

Q: How do teams know whether a public boundary registry is still trustworthy?

A: A boundary registry is trustworthy only if it stays accurate enough for browsers to enforce isolation consistently.

Practitioner guidance

• Review tenant-boundary assumptions in shared-domain designs Map every customer-facing subdomain and identify where browser cookie scope, session sharing, and tenant isolation rely on a public suffix boundary rather than a dedicated domain.
• Test for cross-tenant cookie acceptance Verify whether any application can set a cookie that reaches beyond its intended tenant namespace, especially on shared hosting and delegated subdomain models.
• Treat boundary registration as an external dependency Build operational plans that do not assume a new public suffix entry will arrive quickly, because tenant isolation should not depend on a volunteer review queue.

Bottom line: Shared-domain platforms depend on browser-enforced boundaries, so cookie scope is a security control rather than a convenience feature.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →