Cross-Origin Resource Sharing: The Decisions That Matter
The browser mechanism, known as CORS, that decides whether a page from one origin may read responses from another origin, controlled by response headers. At a g...
Category · 251 articles
Websites and web products that load fast, read clearly and hold up under maintenance.
The browser mechanism, known as CORS, that decides whether a page from one origin may read responses from another origin, controlled by response headers. At a g...
A browser feature that checks a script or stylesheet loaded from a CDN against a cryptographic hash, refusing to run it if the file has been altered. What is at...
A class of vulnerability, known as XSS, where an attacker gets malicious script to run in other users' browsers through content a site displays without proper h...
An attack, known as CSRF, where a malicious site causes a logged-in user's browser to send an unwanted request to another site, such as changing an email addres...
A vulnerability where user input is inserted into a database query in a way that lets an attacker change the query, reading or modifying data they should not ac...
The Open Worldwide Application Security Project's list of the most critical web application security risks, updated periodically from industry data. At a glance...
How applications store user passwords so that a database breach does not reveal them, using slow, salted password hashing algorithms. What is at stake Passwords...
Limiting how many requests a client can make in a given time, especially to login, password reset and API endpoints, to slow down automated attacks. The key fig...
Managing the security of third-party packages a website depends on, from npm and Composer libraries to plugins and themes. Where most projects go wrong The usua...
Keeping API keys, database passwords and other credentials out of source code, using environment variables or a secrets manager instead. Why does it matter? Sec...
How to take a site offline temporarily for maintenance without harming search visibility, using a 503 Service Unavailable status and a clear message for visitor...
Baseline is a shared label for web platform features that work across all the major browsers, used to decide which features are safe to use without fallbacks. W...
Showing 84 of 251
The work behind this topic, and what it costs.