RoastMyOpsecBlog
Defensive defaults that keep browsers, cookies, email, and TLS from doing attackers' homework. Ten guides per page.
Page 2 of 7
Safety · Aug 29, 2025
SameSite=Strict vs Lax for login cookies is when the browser attaches that cookie on a request that started on another site: Lax still sends it on top-level GET navigations, while Strict withholds it on all cross-site…
Read guide →Safety · Aug 21, 2025
SameSite=None vs Lax for third-party embeds is a cookie-attachment decision, not a branding toggle. SameSite=Lax (or Strict) keeps the session cookie off most cross-site POSTs and off many cross-site navigations.…
Read guide →Safety · Jun 22, 2025
Referrer-Policy vs URL leaks is a default you should set on purpose. When a user clicks from your HTTPS page to another origin, the browser may send a Referer header that includes path and query. If those URLs hold…
Read guide →Safety · Jun 14, 2025
Referrer-Policy no-referrer vs strict-origin is how much of the current URL the browser may put in Referer: no-referrer sends nothing, while strict-origin sends only the origin on HTTPS-to-HTTPS hops and nothing on a…
Read guide →Safety · Apr 7, 2025
Private Network Access vs CORS for browser APIs is two different gates. CORS (Access-Control-Allow-Origin) decides whether a web page may read a cross-origin HTTP response. Private Network Access (PNA, evolving as Local…
Read guide →Safety · Feb 6, 2025
Permissions-Policy vs device APIs is a default-deny choice for public HTML. The header (formerly Feature-Policy) tells the browser which powerful APIs this document and its iframes may use. A brochure site should…
Read guide →Safety · Jan 29, 2025
Permissions-Policy unload vs beforeunload is a browser-lifecycle split, not two spellings of one header: the unload feature gates the window unload event (handlers that break back-forward cache), while beforeunload is a…
Read guide →Safety · Jan 20, 2025
Partitioned cookies vs SameSite=None is how browsers are shrinking the shared third-party jar. SameSite=None; Secure still lets an embed send one cookie on every site that frames you — a cross-site identity. The…
Read guide →Safety · Dec 26, 2024
Origin vs Referer for CSRF defense is a metadata choice, not a token replacement. The Origin header carries scheme-host-port without a path. The Referer (legacy spelling) can include the full URL — which is a leak — and…
Read guide →Safety · Dec 17, 2024
Origin-Agent-Cluster vs COOP for process isolation is two complementary browser isolation knobs, not substitutes. Origin-Agent-Cluster: ?1 asks supporting browsers to put this origin in its own agent cluster — a…
Read guide →