RoastMyOpsecBlog
Defensive defaults that keep browsers, cookies, email, and TLS from doing attackers' homework. Ten guides per page.
Page 3 of 7
Safety · Sep 23, 2024
MTA-STS vs DMARC for public domain email is two layers that do not replace each other. DMARC (with SPF and DKIM) is how you tell receivers what to do when From alignment fails — none, quarantine, or reject. MTA-STS (RFC…
Read guide →Safety · Sep 14, 2024
Mixed content vs HTTPS is not a choice between two equivalent setups. HTTPS on the HTML document only protects that response. If the page then loads scripts, stylesheets, or other active assets over http://, a network…
Read guide →Safety · Sep 6, 2024
Min TLS version at the CDN vs the origin is which handshake the public internet actually sees: visitors terminate TLS on the edge, so origin-only 1.2+ never helps if the CDN still offers 1.0, and a bypassed origin IP…
Read guide →Safety · Aug 28, 2024
localStorage vs HttpOnly cookies for session tokens is not a framework fashion contest. localStorage (and document.cookie without HttpOnly) is readable to any script that runs on the page — including XSS and a sloppy…
Read guide →Safety · Jun 4, 2024
iframe sandbox vs CSP frame-ancestors is two directions of iframe policy. sandbox on your <iframe> limits what that child document may do (scripts, forms, top-navigation, same-origin access). CSP frame-ancestors — and…
Read guide →Safety · May 10, 2024
HttpOnly vs Secure vs SameSite is not an either-or decision for session cookies. HttpOnly keeps the cookie out of document.cookie. Secure stops it from traveling on HTTP. SameSite limits when the browser attaches it to…
Read guide →Safety · Mar 28, 2024
HSTS vs HTTPS redirects is not a contest with one winner. A redirect sends this visit to HTTPS. HTTP Strict-Transport-Security tells supporting browsers to remember HTTPS for a max-age, cutting off later cleartext first…
Read guide →Safety · Mar 20, 2024
HSTS preload vs includeSubDomains for public sites is a first-visit commitment versus a header bit on later visits. includeSubDomains tells a browser that already learned HSTS from this host to apply it to subdomains…
Read guide →Safety · Mar 11, 2024
HSTS max-age six months vs two years is how long supporting browsers remember to skip HTTP after they see Strict-Transport-Security on HTTPS: six months is 15552000 seconds — the bar RoastMyOpsec uses when it flags a…
Read guide →Safety · Feb 15, 2024
__Host- vs __Secure- cookie prefixes is how you stop a weaker Set-Cookie from impersonating your session name. Browsers that honor prefixes refuse to store __Secure- unless Secure is set, and refuse __Host- unless…
Read guide →