Security field notes

Understand the bug. See the exploit. Ship the fix.

Practical guides to real-world web vulnerabilities, written by the team building the scanner that finds them.

Find a vulnerability guide

65 deep-dives · 27 topics

Follow via RSS

Posts tagged #security-headers

2 posts

All topics Clear tag filter

Access & configurationOverview Content-Security-Policy: script-src 'self' 'unsafe-inline'

Security Headers8 min read

HTTP Security Headers, Explained: The Browser Defenses You Have to Ask For

Browsers can block injected script, refuse framing, insist on HTTPS and guard cookies, but only when the response asks. Here is what each security header does, what a missing header or a mislabeled response costs, and a configuration that holds.

Access & configuration <input type="password" name="password">

Security Headers7 min read

Password Autocomplete: What the Browser Remembers and How to Mark Password Fields

Browsers offer to save and refill passwords unless the page says what each field is for. Here is what the autocomplete attribute can and cannot control, where a saved password does real harm, and how to mark sign-in, sign-up, reset and one-time fields.