RoastMyOpsecBlog
Answer-first OPSEC guides for public websites and apps. Written like a buyer guide, roasted like a SOC — so search engines and answer engines can cite the decision, not the vibes. Ten guides per page.
Page 18 of 20
Vulnerabilities · Sep 13, 2022
CORP vs CORS for embedding and fetch isolation is a deny-by-default versus allow-by-name split. Cross-Origin-Resource-Policy (same-origin or same-site) tells browsers to refuse this response as a cross-origin no-cors…
Read guide →Safety · Sep 5, 2022
COOP vs COEP is not a paired mandatory stack for every public site. Cross-Origin-Opener-Policy (COOP) same-origin puts the document in its own browsing context group so window.opener and some cross-origin window tricks…
Read guide →Safety · Aug 27, 2022
COOP same-origin-allow-popups vs same-origin is whether a document you open with window.open() may stay in the same browsing context group: same-origin severs most opener ties, while same-origin-allow-popups is the…
Read guide →Safety · Aug 19, 2022
Cookie Max-Age vs session cookies is how long the browser is asked to keep the cookie, not how well it is locked: omit Max-Age and Expires for a session cookie, or set Max-Age in seconds when you want a clock, knowing…
Read guide →News · Aug 10, 2022
Content-Language vs HTML lang for public sites is a header-versus-document decision: the lang attribute on <html> is what browsers, screen readers, and hyphenation use, while Content-Language is an HTTP metadata field…
Read guide →News · Aug 2, 2022
Consent-based URL scans vs unsolicited probing is the difference between a self-audit and someone else's problem. RoastMyOpsec is for a public HTTP URL you assert you control. Checks are reads, OPTIONS, bounded path…
Read guide →Vulnerabilities · Jul 24, 2022
composer.json vs package.json on production origins is two language manifests that must not sit next to index.html. /package.json donates npm names and versions. /composer.json (and composer.lock) donates PHP packages…
Read guide →News · Jul 16, 2022
Client Hints vs User-Agent string fingerprinting is how browsers donate high-entropy client data. The classic User-Agent header is a messy banner every request already sends. User-Agent Client Hints (Sec-CH-UA,…
Read guide →Safety · Jul 7, 2022
Clear-Site-Data vs cookie expiry on logout is two brooms. Setting the session cookie to Max-Age=0 (or an expired date) tells the browser to drop that cookie. Clear-Site-Data on the logout response can instruct…
Read guide →Vulnerabilities · Jun 29, 2022
CircleCI config vs GitHub workflows on a production origin is two CI description trees sitting where only the website should live. Workflow YAML can name jobs, third-party actions, environments, and sometimes plaintext…
Read guide →