Guides

Writing a Content-Security-Policy that actually stops XSSMost deployed CSPs enforce nothing. The difference between a policy that works and one that decorates comes down to two rules. The security header checklist, in the order worth doing themWhich headers to add first, what each one actually prevents, and which popular advice is now out of date. CORS: the one header where setting it is the riskAccess-Control-Allow-Origin relaxes the same-origin policy. The common fix for a CORS error is also the dangerous one.