RoastMyOpsecBlog
Answer-first OPSEC guides for public websites and apps. Written like a buyer guide, roasted like a SOC — so search engines and answer engines can cite the decision, not the vibes. Ten guides per page.
Page 17 of 20
Safety · Dec 7, 2022
CSP frame-ancestors none vs self is who may put your document in a frame: 'none' matches X-Frame-Options DENY (no parent, including your own origin), and 'self' matches SAMEORIGIN so same-origin tools may iframe the…
Read guide →Safety · Nov 29, 2022
CSP form-action vs open redirects on public sites is two different hops. form-action in Content-Security-Policy tells supporting browsers which origins an HTML form may submit to. An open redirect is a server Location…
Read guide →Safety · Nov 20, 2022
CSP font-src vs hosted web fonts on public sites is a fetch allowlist versus a privacy and supply-chain choice. font-src lists which origins may provide fonts for @font-face. style-src still controls the stylesheet that…
Read guide →Safety · Nov 12, 2022
CSP default-src vs named directives for public sites is a fallback versus an explicit fetch type. default-src sets the allowlist for fetch types you did not name — scripts, images, fonts, connect, and more, with…
Read guide →Safety · Nov 3, 2022
CSP connect-src vs public JavaScript API keys is a destination allowlist versus a credential in the browser. connect-src in Content-Security-Policy limits fetch, XHR, WebSocket, and EventSource URLs the page may open. A…
Read guide →Safety · Oct 26, 2022
CSP child-src vs worker-src for public sites is an old combined directive versus the split that replaced it. child-src used to cover nested browsing contexts (frames) and workers. Today, frame-src lists which hosts may…
Read guide →Safety · Oct 17, 2022
CSP base-uri vs open redirects on public sites is two different ways URLs get rewritten. base-uri in Content-Security-Policy limits which origins may appear in a <base href> (and the fallback document URL). An injected…
Read guide →Vulnerabilities · Oct 9, 2022
crossdomain.xml vs CORS for public browser APIs is two generations of cross-origin policy. CORS (Access-Control-Allow-Origin and friends) is what browsers enforce on fetch and XHR. /crossdomain.xml is an Adobe Flash…
Read guide →Vulnerabilities · Sep 30, 2022
CORS wildcard vs allowlist is a trust-boundary choice for browser-called APIs, not a performance tweak. Access-Control-Allow-Origin: * is acceptable only for responses that are meant to be read by any website and that…
Read guide →Vulnerabilities · Sep 22, 2022
CORS credentials vs wildcard origins is a combination the Fetch spec forbids. If Access-Control-Allow-Credentials is true, Access-Control-Allow-Origin must be an explicit origin, not *. Reflecting any Origin while…
Read guide →