RoastMyOpsecBlog
Defensive defaults that keep browsers, cookies, email, and TLS from doing attackers' homework. Ten guides per page.
Page 7 of 7
Safety · Sep 5, 2022
COOP vs COEP is not a paired mandatory stack for every public site. Cross-Origin-Opener-Policy (COOP) same-origin puts the document in its own browsing context group so window.opener and some cross-origin window tricks…
Read guide →Safety · Aug 27, 2022
COOP same-origin-allow-popups vs same-origin is whether a document you open with window.open() may stay in the same browsing context group: same-origin severs most opener ties, while same-origin-allow-popups is the…
Read guide →Safety · Aug 19, 2022
Cookie Max-Age vs session cookies is how long the browser is asked to keep the cookie, not how well it is locked: omit Max-Age and Expires for a session cookie, or set Max-Age in seconds when you want a clock, knowing…
Read guide →Safety · Jul 7, 2022
Clear-Site-Data vs cookie expiry on logout is two brooms. Setting the session cookie to Max-Age=0 (or an expired date) tells the browser to drop that cookie. Clear-Site-Data on the logout response can instruct…
Read guide →Safety · Jun 20, 2022
Certificate expiry vs HSTS is not a pick-one control. A trusted, unexpired certificate is what makes this HTTPS visit work. HTTP Strict-Transport-Security is what tells browsers to skip HTTP next time. An expired or…
Read guide →Safety · May 17, 2022
Cache-Control public vs private is a shared-cache decision, not a performance slogan. public means a CDN or browser may store the response for reuse across users. private means only the end user's browser should keep…
Read guide →Safety · May 9, 2022
CAA records vs registrar lock are two different doors on the same house. Certification Authority Authorization (CAA) is a DNS record that tells public CAs which issuers are allowed to mint certificates for your domain.…
Read guide →