Enabling subdomain isolation

About subdomain isolation

Subdomain isolation mitigates cross-site scripting and other related vulnerabilities. For more information, see "Cross-site scripting" on Wikipedia. We highly recommend that you enable subdomain isolation on GitHub Enterprise Server 인스턴스.

When subdomain isolation is enabled, GitHub Enterprise Server replaces several paths with subdomains. After enabling subdomain isolation, attempts to access the previous paths for some user-supplied content, such as http(s)://HOSTNAME/raw/, may return 404 errors.

Path without subdomain isolation	Path with subdomain isolation
`http(s)://HOSTNAME/`	`http(s)://docker.HOSTNAME/`
`http(s)://HOSTNAME/_registry/npm/`	`https://npm.HOSTNAME/`
`http(s)://HOSTNAME/_registry/rubygems/`	`https://rubygems.HOSTNAME/`
`http(s)://HOSTNAME/_registry/maven/`	`https://maven.HOSTNAME/`
`http(s)://HOSTNAME/_registry/nuget/`	`https://nuget.HOSTNAME/`
`http(s)://HOSTNAME/assets/`	`http(s)://assets.HOSTNAME/`
`http(s)://HOSTNAME/avatars/`	`http(s)://avatars.HOSTNAME/`
`http(s)://HOSTNAME/codeload/`	`http(s)://codeload.HOSTNAME/`
`http(s)://HOSTNAME/gist/`	`http(s)://gist.HOSTNAME/`
`http(s)://HOSTNAME/media/`	`http(s)://media.HOSTNAME/`
`http(s)://HOSTNAME/notebooks/`	`http(s)://notebooks.HOSTNAME/`
`http(s)://HOSTNAME/pages/`	`http(s)://pages.HOSTNAME/`
`http(s)://HOSTNAME/raw/`	`http(s)://raw.HOSTNAME/`
`http(s)://HOSTNAME/reply/`	`http(s)://reply.HOSTNAME/`
`http(s)://HOSTNAME/uploads/`	`http(s)://uploads.HOSTNAME/`
`http(s)://HOSTNAME/viewscreen/`	`http(s)://viewscreen.HOSTNAME/`
Not supported	`https://containers.HOSTNAME/`

Prerequisites

경고: 하위 도메인 격리를 사용하지 않도록 설정한 경우 엔터프라이즈에서 GitHub Pages를 사용하지 않도록 설정하는 것이 좋습니다. 사용자가 제공한 GitHub Pages 콘텐츠를 나머지 엔터프라이즈 데이터와 격리할 수 있는 방법은 없습니다. 자세한 내용은 "Configuring GitHub Pages for your enterprise"을(를) 참조하세요.

Before you enable subdomain isolation, you must configure your network settings for your new domain.

Specify a valid domain name as your hostname, instead of an IP address. For more information, see "Configuring the hostname for your instance."

경고: 초기 설정 후 GitHub Enterprise Server의 호스트 이름을 변경하지 마세요. 호스트 이름을 변경하면 예기치 못한 동작이 발생합니다. 최악의 경우 인스턴스 중단 및 사용자 보안 키 무효화 등을 포함합니다. 인스턴스의 호스트 이름을 변경했고 문제가 발생한 경우, GitHub Enterprise 지원 또는 GitHub Premium 지원에 문의하십시오.

Set up a wildcard Domain Name System (DNS) record or individual DNS records for the subdomains listed above. We recommend creating an A record for *.HOSTNAME that points to your server's IP address so you don't have to create multiple records for each subdomain.
Get a wildcard Transport Layer Security (TLS) certificate for *.HOSTNAME with a Subject Alternative Name (SAN) for both HOSTNAME and the wildcard domain *.HOSTNAME. For example, if your hostname is github.octoinc.com, get a certificate with the Common Name value set to *.github.octoinc.com and a SAN value set to both github.octoinc.com and *.github.octoinc.com.
Enable TLS on your appliance. For more information, see "Configuring TLS."