RoastMyOpsecBlog
Defensive defaults that keep browsers, cookies, email, and TLS from doing attackers' homework. Ten guides per page.
Page 4 of 7
Safety · Nov 13, 2023
Sec-Fetch-Site vs Origin for CSRF defense is two browser-supplied labels, not a token replacement. Sec-Fetch-Site is Fetch Metadata: same-origin, same-site, cross-site, or none (user-initiated, no referrer). Origin is…
Read guide →Safety · Oct 18, 2023
Feature-Policy vs Permissions-Policy is the same job under a new header name. Feature-Policy was the experimental name. Permissions-Policy is the standardized header that tells the browser which powerful APIs this…
Read guide →Safety · Sep 6, 2023
Expect-CT vs Certificate Transparency is a leftover header versus a living ecosystem. Expect-CT told browsers to require CT evidence and optionally report failures. Chrome dropped enforcement; MDN marks the header…
Read guide →Safety · Jul 17, 2023
Document-Policy vs Permissions-Policy for page features is two structured-header policies, not one misspelled header. Permissions-Policy (and legacy Feature-Policy) allowlists powerful APIs: camera, microphone,…
Read guide →Safety · Jun 21, 2023
X-DNS-Prefetch-Control vs Referrer-Policy is two different gossip networks. Referrer-Policy limits what the next site sees in the Referer header — path, query, origin, or nothing. X-DNS-Prefetch-Control (and <link…
Read guide →Safety · Jun 13, 2023
DNS hygiene vs DNSSEC and registrar lock is a stack, not a single checkbox. Hygiene is knowing who your nameservers are, removing stale records, and using a registrar you can actually recover. Registrar transfer lock…
Read guide →Safety · May 1, 2023
DANE TLSA vs CAA for public site certificates is two DNS controls that people mix up. CAA (RFC 8659) tells CAs which issuers may mint a cert for the name — a policy the CA ecosystem is supposed to honor. DANE (RFC 6698)…
Read guide →Safety · Apr 23, 2023
CSRF tokens vs SameSite is a pairing, not an either-or contest. SameSite on the session cookie reduces how often a foreign site can attach credentials to a request. Anti-CSRF tokens (or Fetch metadata / Origin checks)…
Read guide →Safety · Apr 14, 2023
CSP worker-src vs script-src is two different script surfaces. script-src allowlists JavaScript that runs in the page. worker-src allowlists URLs that may be used as Worker, SharedWorker, and Service Worker scripts. If…
Read guide →Safety · Apr 6, 2023
CSP vs X-Frame-Options is a choice between a modern framing policy and a legacy header that older browsers still understand. Content-Security-Policy frame-ancestors is the stronger, more precise control for new sites.…
Read guide →