Cybersecurity

Cybersecurity / 22 Sep 2026 / 6 min read

Subresource Integrity Pins External Resources to Expected Bytes

Subresource Integrity Pins External Resources to Expected Bytes Loading a script or stylesheet from another host creates a direct dependency on the bytes that host returns. TLS protects the connection in transit, but it does not state that the response is the exact object the page operator intended to execute or apply. Subresource Integrity (SRI) adds that byte-level condition. An HTML element can carry integrity metadata containing one or more cryptographic digests. A supporting browser fetches the resource, computes the relevant digest, and uses the response only when the result satisfies the metadata.

Cybersecurity Web Security

Cybersecurity / 22 Sep 2026 / 7 min read

Subresource Integrity Pins Browser-Loaded Assets to Approved Bytes

Subresource Integrity Pins Browser-Loaded Assets to Approved Bytes A web page can load executable code from infrastructure outside the application’s deployment boundary. A <script> URL may point to a CDN, a package distribution endpoint, or another origin operated under a separate release process. TLS protects the connection to that endpoint, but a valid HTTPS response can still contain bytes different from the version the page author intended to run. Subresource Integrity, commonly shortened to SRI, adds a content check at the browser. The document carries cryptographic digest metadata for a resource. After fetching the resource, the browser computes the applicable digest and compares it with the metadata before accepting the resource for the protected use.

Cybersecurity Web Security

Cybersecurity / 22 Sep 2026 / 5 min read

SameSite Cookies Restrict Cross-Site Credential Sending

SameSite Cookies Restrict Cross-Site Credential Sending Cookies are ambient credentials: once stored, a browser can attach them to matching requests without application code explicitly supplying each value. That convenience also creates a security boundary. A page on one site may cause a browser to send a request to another site, and an authentication cookie attached to that request can make it act with the user’s session. The SameSite cookie attribute narrows that behavior. It tells the browser when a cookie is eligible to accompany requests whose site context differs from the site that set the cookie. The attribute is useful against classes of cross-site request forgery, but it is not a complete authorization mechanism and does not replace CSRF tokens or server-side request checks where those controls are required.

Cybersecurity Web Security

Cybersecurity / 22 Sep 2026 / 5 min read

SameSite Cookies Constrain Cross-Site Credential Sending

SameSite Cookies Constrain Cross-Site Credential Sending Cookies are ambient credentials: once a browser stores a cookie that matches a request’s domain, path, security, and expiry rules, application code does not have to add that cookie explicitly to every request. That convenience also creates a security boundary. A page on one site can cause a browser to send requests to another site, and some of those requests may carry cookies. The SameSite attribute gives the browser another condition to evaluate before attaching a cookie. It does not change the cookie’s value or authenticate the request by itself. It controls cookie inclusion according to the relationship between the request context and the cookie’s site.

Cybersecurity Cookies

Cybersecurity / 22 Sep 2026 / 5 min read

Referrer-Policy Reduces Referrer Data on Outbound Requests

Referrer-Policy Reduces Referrer Data on Outbound Requests A browser can attach a Referer request header when a document navigates to another page or fetches a subresource. Without a suitable policy, that header can expose more of the source URL than the destination needs. Paths can contain internal object names, routing details, campaign parameters, or other context that should not cross a trust boundary. Referrer-Policy gives a site control over that disclosure. The policy determines which referrer information the browser may attach to eligible requests. It does not authenticate the destination, encrypt traffic, or replace URL design discipline. Its role is narrower: reduce the source URL data released by the browser.

Cybersecurity Web Security

Cybersecurity / 22 Sep 2026 / 6 min read

Referrer-Policy Limits URL Data Sent Across Requests

Referrer-Policy Limits URL Data Sent Across Requests A URL can contain more information than a destination needs. Paths and query strings may expose document identifiers, search terms, workflow state, or other context. When a browser follows a link or fetches a resource, referrer handling determines how much of the source URL can accompany that request in the HTTP Referer header. Referrer-Policy gives the response an explicit rule for that disclosure. It does not encrypt URLs or remove data already sent elsewhere. Its role is narrower: constrain referrer information emitted by the browser for subsequent requests.

Cybersecurity Web Security

Cybersecurity / 22 Sep 2026 / 5 min read

Permissions-Policy Narrows Browser Feature Access

Permissions-Policy Narrows Browser Feature Access A web document can sit close to powerful browser capabilities. Depending on browser support, context, user permission, and policy, code may request access to features such as geolocation, camera, microphone, or fullscreen. An embedded document can also inherit access to some features from the page that contains it. Permissions-Policy adds a server-controlled restriction layer. A response can declare which origins are eligible to use selected features in a document and its frame tree. The policy does not grant a user permission and does not make an origin trustworthy. It removes capability from contexts that do not need it.

Cybersecurity Web Security

Cybersecurity / 22 Sep 2026 / 6 min read

Permissions Policy Constrains Browser Feature Access

Permissions Policy Constrains Browser Feature Access A web document can contain first-party code, third-party scripts, and embedded frames that execute within different origins. Browser APIs then add another boundary: some features expose sensors, media devices, display state, or other capabilities that a site may not want every embedded context to use. Permissions-Policy lets a response declare which origins may use selected browser features in the document and its descendants. The policy is a capability boundary, not a replacement for the permission prompt shown to a person. A feature can be permitted by policy and still be denied by browser permission state, platform settings, secure-context requirements, or other API-specific conditions.

Cybersecurity Web Security

Cybersecurity / 22 Sep 2026 / 6 min read

OCSP Stapling Carries Certificate Status in the TLS Handshake

OCSP Stapling Carries Certificate Status in the TLS Handshake Certificate validation has two distinct questions. A client must establish that a certificate chains to a trusted authority and is valid for the intended identity, but it may also need current evidence that the certificate has not been revoked before its scheduled expiration. The Online Certificate Status Protocol, or OCSP, provides signed status responses for certificates. A client can query an OCSP responder directly, but that adds another network dependency to connection setup and can expose the certificate being checked to the responder. OCSP stapling moves a cached response into the TLS exchange: the server obtains status evidence and presents it to clients that request it.

Cybersecurity TLS

Cybersecurity / 22 Sep 2026 / 5 min read

HSTS Pins HTTPS Policy to Hostnames

HSTS Pins HTTPS Policy to Hostnames HTTPS protects an HTTP exchange after a secure connection has been established and authenticated. A separate problem appears before that point: a user can enter a bare hostname, follow an http:// link, or reach a redirecting HTTP endpoint before the browser has any transport policy for the site. HTTP Strict Transport Security (HSTS) addresses that transition. An HTTPS server sends a Strict-Transport-Security response header, and a conforming user agent records a policy for the host. While that policy remains active, matching HTTP requests are converted to HTTPS before an insecure network request is sent.

Cybersecurity HTTPS

Cybersecurity / 22 Sep 2026 / 5 min read

HSTS Enforces HTTPS After a Secure Origin Establishes Policy

HSTS Enforces HTTPS After a Secure Origin Establishes Policy HTTPS protects an HTTP exchange only after a secure connection is in use. A user can still type a bare hostname, follow an http:// link, or encounter an application that redirects HTTP to HTTPS. That initial HTTP request exists before an ordinary redirect can move the browser onto TLS. HTTP Strict Transport Security (HSTS) moves the redirect decision into the user agent. A host sends the Strict-Transport-Security response header over HTTPS. Once the browser accepts that policy, later attempts to access the covered host with HTTP are rewritten to HTTPS before an insecure HTTP request is sent.

Cybersecurity Web Security

Cybersecurity / 22 Sep 2026 / 4 min read

Fetch Metadata Lets Servers Filter Cross-Site Requests

Fetch Metadata Lets Servers Filter Cross-Site Requests A server often receives enough HTTP data to process a request but not enough context to classify the browser action that produced it. Fetch Metadata request headers add that context. Supporting browsers send Sec-Fetch-* fields that describe the relationship between the initiator and target, the request mode, the destination, and whether a navigation was triggered by a user activation. These headers can support a resource-isolation policy at the server. An endpoint intended only for same-origin application traffic can reject requests whose metadata shows an unexpected cross-site context before application logic handles them.

Cybersecurity Web Security

Cybersecurity / 22 Sep 2026 / 6 min read

DNSSEC Authenticates DNS Data with a Signed Chain

DNSSEC Authenticates DNS Data with a Signed Chain DNS normally answers a naming question: which records are associated with a domain name? The protocol’s basic response path does not, by itself, give a validating resolver cryptographic evidence that the returned record set is the data authorized by the zone owner. DNS Security Extensions, or DNSSEC, add that evidence. A signed zone publishes public keys and signatures that allow a validating resolver to authenticate DNS data through a chain rooted in a configured trust anchor. DNSSEC protects authenticity and integrity of DNS data. It does not encrypt queries or responses, and it does not conceal the names being requested.

Cybersecurity DNS

Cybersecurity / 22 Sep 2026 / 6 min read

DNS CAA Narrows Certificate Authority Issuance

DNS CAA Narrows Certificate Authority Issuance Public certificate issuance depends on a certificate authority validating control of the requested domain name. DNS Certification Authority Authorization (CAA) adds a separate policy signal: a domain can publish which certificate authorities are permitted to issue for that name. CAA does not replace domain-control validation, prove that a requester is legitimate, or protect a private key. Its role is narrower. A conforming public certificate authority checks the applicable CAA policy before issuance and must not issue when that policy forbids it.

Cybersecurity PKI

Cybersecurity / 22 Sep 2026 / 5 min read

CSP frame-ancestors Restricts Who Can Embed a Page

CSP frame-ancestors Restricts Who Can Embed a Page A web page can be security-sensitive even when an attacker cannot read its DOM. If another site can place that page inside a transparent or carefully positioned frame, the attacker may arrange visible controls so a user interacts with the framed application while believing they are interacting with something else. This class of UI redressing is commonly associated with clickjacking. The Content Security Policy directive frame-ancestors gives the framed response control over that boundary. Instead of trusting the embedding page to behave safely, the protected response declares which ancestors are permitted to contain it.

Cybersecurity Web Security

Cybersecurity / 22 Sep 2026 / 6 min read

Cross-Origin-Resource-Policy Controls Resource Embedding

Cross-Origin-Resource-Policy Controls Resource Embedding A server can publish an image, script, font, or other resource at a URL without intending every site on the web to embed it. Network reachability alone does not express that boundary. A browser may be able to request a resource even when the response is not exposed to JavaScript through the same-origin policy. Cross-Origin-Resource-Policy (CORP) gives the resource server a response-side control for that case. The header tells supporting browsers which relationship between the requesting context and the resource is acceptable for relevant no-CORS requests. If the relationship violates the policy, the browser blocks use of the response body.

Cybersecurity Web Security

Cybersecurity / 22 Sep 2026 / 5 min read

Cross-Origin-Opener-Policy Separates Top-Level Browsing Contexts

Cross-Origin-Opener-Policy Separates Top-Level Browsing Contexts A browser window is not isolated merely because it displays a document from another origin. Windows can retain relationships through mechanisms such as window.opener, and those relationships affect which browsing contexts occupy the same browsing context group. Cross-Origin-Opener-Policy (COOP) gives a top-level document control over that grouping boundary. It is delivered as an HTTP response header and can cause cross-origin documents to be placed in separate browsing context groups.

Cybersecurity Web Security

Cybersecurity / 22 Sep 2026 / 5 min read

Cross-Origin-Embedder-Policy Requires Resource Opt-In

Cross-Origin-Embedder-Policy Requires Resource Opt-In A page can pull scripts, images, fonts, workers, frames, and other resources from origins outside its own. Those dependencies often cross an administrative boundary as well as an origin boundary. Cross-Origin-Embedder-Policy (COEP) lets a document require stronger conditions before the browser loads cross-origin resources into its context. The common restrictive value is: Cross-Origin-Embedder-Policy: require-corp With require-corp, a cross-origin resource loaded without CORS must explicitly permit the embedding context through Cross-Origin Resource Policy (CORP). Resources fetched in CORS mode can instead satisfy the relevant CORS checks.

Cybersecurity Web Security

Cybersecurity / 22 Sep 2026 / 5 min read

Cookie Prefixes Bind Browser-Enforced Constraints to Cookie Names

Cookie Prefixes Bind Browser-Enforced Constraints to Cookie Names HTTP cookies carry security attributes such as Secure, HttpOnly, Domain, and Path. Cookie prefixes add another layer: a reserved pattern in the cookie name tells a supporting browser that specific attributes must accompany the cookie. If the Set-Cookie header violates that contract, the browser rejects the cookie instead of storing it under weaker settings. This mechanism is useful because configuration intent becomes visible in the name itself. A session cookie named with a host-bound prefix cannot silently drift into a domain-scoped cookie without failing the browser’s prefix checks.

Cybersecurity HTTP Cookies

Cybersecurity / 22 Sep 2026 / 5 min read

Content Security Policy Nonces Authorize Individual Script Elements

Content Security Policy Nonces Authorize Individual Script Elements Inline JavaScript creates a difficult boundary for a strict Content Security Policy. A page may need a small bootstrap block generated by the application, while arbitrary inline script must remain blocked. Allowing all inline execution with 'unsafe-inline' removes much of the value of script-src. A nonce gives the response a narrower mechanism. The server generates an unpredictable value for that response, places it in the CSP source list, and attaches the same value only to script elements that are meant to execute.

Cybersecurity Web Security

Cybersecurity / 22 Sep 2026 / 5 min read

Clear-Site-Data Resets Browser State for an Origin

Clear-Site-Data Resets Browser State for an Origin A logout endpoint can invalidate a server-side session and still leave browser state behind. Cached responses, cookies, DOM storage, and other client-side data may survive unless the application addresses them separately. That residue does not automatically create a vulnerability, but it matters when a security boundary depends on returning a browser profile to a cleaner state. The HTTP Clear-Site-Data response header gives a server a browser-enforced reset mechanism. A response names one or more data classes, and a supporting user agent clears the matching state associated with the response origin according to the header’s processing rules.

Cybersecurity Web Security

Cybersecurity / 22 Sep 2026 / 6 min read

Certificate Transparency Exposes Certificate Issuance to Public Audit

Certificate Transparency Exposes Certificate Issuance to Public Audit A publicly trusted TLS certificate is an assertion made by a certificate authority. Traditional PKI gives clients a way to validate that assertion against trusted roots, but successful path validation alone does not make certificate issuance publicly visible. Certificate Transparency, commonly abbreviated CT, adds an audit layer. Participating logs accept certificate entries and commit them to append-only data structures. The resulting evidence lets clients, domain operators, and monitors detect certificates that have entered the public Web PKI, including certificates an operator did not expect to exist.

Cybersecurity TLS

Cybersecurity / 22 Sep 2026 / 6 min read

CAA Records Constrain Certificate Authority Issuance

CAA Records Constrain Certificate Authority Issuance A certificate authority can validate control of a domain and still face a separate policy question: is this CA authorized by the domain operator to issue for that name? Certification Authority Authorization, or CAA, gives the DNS namespace a record type for expressing that constraint. CAA operates before certificate issuance. A participating public CA checks the relevant DNS CAA policy and evaluates whether its issuer identity is authorized. The mechanism does not make a certificate trusted, revoke an existing certificate, or tell a browser to reject a certificate after issuance. It narrows the set of issuers that should create new certificates for the domain.

Cybersecurity DNS

Cybersecurity / 21 Sep 2026 / 5 min read

WebAuthn RP ID Scopes Credential Use

WebAuthn RP ID Scopes Credential Use A WebAuthn credential is not a reusable key that any website can request from an authenticator. Registration and authentication are tied to a relying party identifier, or RP ID, while the browser also evaluates the calling origin. That pairing creates a domain boundary around public-key credentials. For a conventional deployment at https://login.example.com, an RP can use the host itself as the RP ID: origin: https://login.example.com RP ID: login.example.com It can also use a registrable domain suffix such as example.com when the deployment needs credentials to serve eligible subdomains:

Cybersecurity WebAuthn