Tag
Security
Study HTTP security controls for transport, cookies, browser isolation, authentication, content policy, and response hardening. This curated hub brings together 61 related resources.
- Comparisons
401 vs 403: Authentication vs Authorization
Understand the difference between 401 Unauthorized and 403 Forbidden. Learn when each status code applies, common mistakes, and how to use them correctly in APIs.
- Comparisons
403 vs 404: Forbidden or Not Found
403 Forbidden vs 404 Not Found: when to admit a resource exists, when to hide it, the GitHub private-repo example, and the debugging cost of masking 403 as 404.
- HTTP Status Codes
425 Too Early: TLS 1.3 0-RTT Replay Protection
425 Too Early tells a client not to send a request in TLS early data because it could be replayed. See the Early-Data header and nginx config for 0-RTT.
- HTTP Status Codes
444 Connection Closed Without Response (nginx)
nginx 444 closes the connection without sending any response. Learn how to use return 444 to drop bots and unknown hosts, and what clients see.
- HTTP Headers
Access-Control-Allow-Credentials Header
Learn how Access-Control-Allow-Credentials controls whether browsers expose responses when credentials (cookies, auth headers) are included in CORS requests.
- HTTP Headers
Access-Control-Allow-Headers Header
Learn how Access-Control-Allow-Headers specifies which custom HTTP headers can be used during cross-origin requests in CORS preflight responses.
- HTTP Headers
Access-Control-Allow-Methods Header
Learn how Access-Control-Allow-Methods specifies which HTTP methods are permitted for cross-origin requests in CORS preflight responses.
- HTTP Headers
Access-Control-Allow-Origin Header: CORS Errors and Fixes
Access-Control-Allow-Origin explained: exact browser errors, why * fails with credentials, why you need Vary: Origin, and fixes for nginx, Express and Django.
- HTTP Headers
Access-Control-Expose-Headers: Read Headers in fetch()
Fix response.headers.get() returning null on cross-origin fetch. Access-Control-Expose-Headers, safelisted headers, and why * fails with credentials.
- HTTP Headers
Authentication-Info Header
Learn how Authentication-Info provides additional authentication data in responses to successful requests. Covers digest authentication and session info.
- HTTP Headers
Authorization Header: Bearer, Basic and 401 Fixes
Authorization header carries credentials as scheme plus token. Bearer and Basic formats, WWW-Authenticate, why proxies strip it, redirects, CORS and storage.
- Comparisons
Cache-Control: no-cache vs no-store
Compare the no-cache and no-store Cache-Control response directives and choose the correct policy for sensitive or frequently changing responses.
- HTTP Headers
Clear-Site-Data Header: Logout and Wipe Browser Data
Clear-Site-Data tells the browser to delete cookies, storage and cache on logout. Directives, quoting rules, HTTPS-only limits, browser gaps, Express and nginx.
- HTTP Headers
Content-Security-Policy Header: Directives, Nonces and Console Errors
Content-Security-Policy (CSP) limits what a page may load or run. Directives, nonces, strict-dynamic, Report-Only rollout, console errors, helmet and Next.js.
- Cookie Attributes
Cookie Prefixes: __Host- and __Secure- Rules
Cookie prefixes make the browser enforce attributes. The exact __Host- and __Secure- rules from RFC 6265bis, how to set them, and why a cookie vanishes.
- Guides
Cookie Security: HttpOnly, SameSite, and Secure Flags
A comprehensive guide to understanding and implementing secure HTTP cookies to protect against XSS, CSRF, and session hijacking attacks.
- Comparisons
Cookie-Based vs Session-Based Authentication
Compare cookie-based and session-based authentication. Understand where state lives, security tradeoffs, scalability implications, and when to use each approach.
- Comparisons
Cookies vs localStorage vs sessionStorage: What to Use
Cookies vs localStorage vs sessionStorage: request behavior, size limits, expiry, tab scope, partitioning, XSS and CSRF risks, and auth token choices.
- Comparisons
CORS vs CSP
Understand the difference between CORS and Content Security Policy. Both are browser security mechanisms but they protect against completely different threats.
- Comparisons
CORS vs CSRF: Response Reads vs Forged Writes
CORS controls cross-origin response reads; CSRF abuses automatically sent credentials. Compare preflights, SameSite, tokens, Origin and Sec-Fetch-Site.
- Guides
Cross-Origin Resource Sharing (CORS)
Master Cross-Origin Resource Sharing (CORS) for secure cross-origin HTTP requests. Learn preflight requests, headers, credentials, and common error solutions.
- HTTP Headers
Cross-Origin-Embedder-Policy
Learn how Cross-Origin-Embedder-Policy (COEP) controls cross-origin resource loading. Required for SharedArrayBuffer and high-resolution timer access.
- HTTP Headers
Cross-Origin-Opener-Policy
Learn how Cross-Origin-Opener-Policy (COOP) isolates your browsing context from cross-origin documents. Required for SharedArrayBuffer and enhanced security.
- HTTP Headers
Cross-Origin-Resource-Policy
Learn how Cross-Origin-Resource-Policy (CORP) blocks no-cors cross-origin requests to protect resources from Spectre attacks and data leaks.
- HTTP Headers
CSP Report-Only Header: Roll Out CSP Safely
Content-Security-Policy-Report-Only tests a policy without blocking. Rollout steps, report-uri vs report-to, sample violation JSON, and cutting noise.
- Glossary
CSRF (Cross-Site Request Forgery)
CSRF tricks a logged-in browser into sending an unwanted request to your site. See how it works, why CORS does not stop it and which defenses actually do.
- Cookie Attributes
Domain
Learn how the Domain cookie attribute controls which domains can access cookies. Understand subdomain sharing, security implications, and restrictions.
- Guides
HTTP Authentication Methods and Best Practices
A comprehensive guide to HTTP authentication methods including Basic Auth, Bearer tokens, API keys, and OAuth 2.0.
- Guides
HTTP Security Headers Checklist: Values and Configs
Which HTTP security headers to send and which to drop: starting values for CSP, HSTS and more, with nginx, Apache, Express, Next.js and Cloudflare config.
- HTTP Methods
HTTP TRACE Method: What It Does and Why to Disable It
HTTP TRACE echoes the request back for diagnostics. Cross-Site Tracing history, why scanners flag "TRACE enabled", and how to disable it in Apache and nginx.
- Comparisons
HTTP vs HTTPS: What TLS Adds and What It Does Not Hide
HTTP vs HTTPS: what TLS encrypts and authenticates, what still leaks (IP, SNI, sizes), where ECH stands, HSTS, mixed content, and the SEO effect of moving to HTTPS.
- Cookie Attributes
HttpOnly Cookie Attribute: XSS Protection
Learn how the HttpOnly cookie attribute protects against XSS attacks by preventing JavaScript access to sensitive cookies.
- Guides
HTTPS Explained: How TLS Secures HTTP
HTTPS is HTTP over TLS. What the TLS handshake does, how certificates prove identity, what HTTPS hides and what it does not, and how to migrate a site safely.
- Comparisons
JWT vs Session Cookies: Logout and Security
Compare stateless JWT bearer tokens with opaque session cookies: revocation, rotation, request size, browser storage, CSRF, XSS and algorithm validation.
- Debug Guides
Mixed Content Blocked: HTTPS Page Requesting HTTP
Fix 'Mixed Content: The page was loaded over HTTPS, but requested an insecure resource': find the http:// URLs, add upgrade-insecure-requests, fix proxies.
- Glossary
Origin (Scheme, Host, Port)
An origin is the scheme, host and port of a URL. See how browsers compare origins for the same-origin policy, CORS and the Origin header, with examples.
- HTTP Headers
Origin Header
Learn how the Origin header identifies where cross-origin requests come from. Essential for CORS security policies and preventing cross-site request forgery.
- Cookie Attributes
Path
Learn how the Path cookie attribute restricts which URL paths can receive cookies. Understand path matching rules and how to scope cookies to specific routes.
- HTTP Headers
Permissions-Policy Header
Learn how the Permissions-Policy header controls which browser features and APIs can be used in your site and embedded iframes. Enhance security and privacy.
- Comparisons
Permissions-Policy vs Feature-Policy
Understand the differences between Permissions-Policy and Feature-Policy headers. Compare syntax changes for geolocation, microphone, camera directives and learn how to migrate.
- Glossary
Preflight Request (CORS OPTIONS)
A CORS preflight is an automatic OPTIONS request the browser sends before a cross-origin request to check permission. See when it fires and how to answer it.
- HTTP Headers
Referer Header: What It Sends and How to Control It
Referer tells a server which page a request came from. What browsers send under the default strict-origin-when-cross-origin policy, and how to trim it.
- HTTP Headers
Referrer-Policy Header
Learn how Referrer-Policy controls how much referrer information is sent with requests. Protect user privacy while maintaining analytics functionality.
- HTTP Headers
Reporting-Endpoints Header: Reporting API Setup
Reporting-Endpoints names the URLs where browsers send CSP, COOP, deprecation and crash reports. Syntax, the default endpoint, and replacing Report-To.
- Glossary
Same-Site vs Same-Origin
Site and origin are not the same. Learn how eTLD+1 and the Public Suffix List define same-site, and why it decides SameSite cookie and CORS behavior.
- Cookie Attributes
SameSite Cookie Attribute: Strict, Lax and None
How SameSite works: Strict, Lax and None, what counts as same-site, why Lax-by-default is Chromium behavior, and how to fix cookies blocked cross-site.
- HTTP Headers
Sec-Fetch-Dest Header: All Values Explained
Sec-Fetch-Dest tells the server where a response will be used: document, iframe, image, script, empty. Full value list and server-side uses.
- HTTP Headers
Sec-Fetch-Mode Header: Values and Server Use
Sec-Fetch-Mode reports the request mode: navigate, cors, no-cors, same-origin or websocket. What sets each value and how servers use it.
- HTTP Headers
Sec-Fetch-Site Header: Block Cross-Site Requests
Sec-Fetch-Site says whether a request is same-origin, same-site, cross-site or user-initiated. Resource isolation policy for Express and nginx, plus CSRF use.
- HTTP Headers
Sec-Fetch-User Header: ?1 and User Activation
Sec-Fetch-User is always ?1 and appears only on user-activated navigations, like a link click. When it is absent and why Safari does not send it.
- Cookie Attributes
Secure
Learn how the Secure cookie attribute ensures cookies are only sent over HTTPS connections. Protect sensitive data from man-in-the-middle attacks.
- HTTP Headers
Server Header: Fingerprinting and How to Hide It
The Server header names the software that answered. Use it to find which layer replied, and hide version numbers in nginx, Apache and Cloudflare, with limits.
- Glossary
SNI (Server Name Indication)
SNI is a TLS extension that sends the hostname in the ClientHello so one IP can serve many certificates. Learn debugging with curl and nginx upstream pitfalls.
- HTTP Headers
Strict-Transport-Security (HSTS) Header: Setup and Preload
Strict-Transport-Security (HSTS) forces HTTPS for a set time. max-age, includeSubDomains, preload rules, nginx and Apache config, and how to roll it back.
- Glossary
TLS Handshake
The TLS handshake negotiates keys and authenticates the server before HTTP data flows. See the TLS 1.3 round trip, ALPN, session resumption and 0-RTT risks.
- HTTP Headers
WWW-Authenticate
Learn how the WWW-Authenticate header specifies authentication methods required to access protected resources. Understand Basic, Bearer, and Digest schemes.
- HTTP Headers
X-Content-Type-Options Header
Learn how X-Content-Type-Options with nosniff prevents browsers from MIME-sniffing responses. Protect against XSS attacks from content type confusion.
- HTTP Headers
X-Frame-Options Header
Learn how X-Frame-Options prevents clickjacking attacks by controlling whether your site can be embedded in frames, iframes, or objects on other domains.
- HTTP Headers
X-Powered-By Header: Remove It in Express, PHP, Next.js
X-Powered-By advertises your framework, such as Express or PHP. Remove it in Express, PHP, Next.js, ASP.NET and nginx, and why it is hygiene, not security.
- HTTP Headers
X-XSS-Protection Header
Deprecated header that enabled browser XSS filters to detect and block reflected cross-site scripting attacks.
- Glossary
XSS (Cross-Site Scripting)
XSS lets an attacker run JavaScript in your page by getting untrusted input rendered as code. Learn the three types, real examples, CSP and HttpOnly limits.