You're viewing the readable version of this site. The interactive extras (search, diagrams, read-aloud) need JavaScript and a current browser. Enable JavaScript; if it is already enabled, update your browser.

Tag

Notes tagged “browsers”

Every note filed under browsers, newest first.

A filtered view of the notes.

2026

  1. Code From Strangers

    A map of web security before the deep dives — one asymmetry that explains every attack, five questions the mechanisms answer, and the vocabulary you need so none of the rest reads as noise.

    security web browsers same-origin-policy csp standards dissecting-systems

  2. HSTS: It's Time to Go HTTPS-Only

    The header that makes HTTPS non-negotiable — no SSL stripping, no click-through, no fast rollback. Turn it on. Then think carefully before you preload, because that part you cannot take back.

    security http tls hsts web browsers privacy dissecting-systems

  3. Nobody Shares Your Address Space

    COOP, COEP and CORP are presented as three related headers. They are three doors into one process — and Spectre is why the browser cares who is inside it, not just what they are allowed to read.

    security http web browsers spectre isolation dissecting-systems

  4. Strings Do Not Remember Where They Came From

    Trusted Types does not make XSS impossible — the spec says so itself. It makes unreviewed assignment impossible, which is a smaller claim and a far more useful one.

    security web xss trusted-types csp browsers types dissecting-systems

  5. The Credential That Predates the Origin

    Cookies do not obey the same-origin policy — they never have. Thirty years of attributes, flags and name prefixes are one long retrofit, and knowing which parts actually hold is most of session security.

    security web cookies sessions http browsers dissecting-systems

  6. The Header That Grants Nothing

    CORS does not protect your server. It relaxes a rule about who may read a reply — and almost every misconfiguration comes from believing it does the opposite.

    security web cors http browsers caching dissecting-systems

  7. Two Parsers Walk Into a DOM

    Every HTML sanitizer is a second implementation of a parser it does not control. Mutation XSS is what happens in the gap — and it is why the fix eventually had to move inside the browser.

    security web xss sanitization svg browsers parsing dissecting-systems

  8. Why Your Progressive Approach to Web Security Fails

    Adding a security header can only tighten what reaches the browser; nothing you add can loosen it. Loosening is a hand edit of the policy already shipped — and that asymmetry is why incremental hardening degenerates into permissive sprawl, and why deny-by-default with a report-only rollout is the only shape that survives a real application.

    security csp http web browsers architecture dissecting-systems

  9. The Good, the Bad, and the Bugly

    When browser bisection almost works—and why stopping can be the right result.

    browsers accessibility csp security debugging art-of-debugging dissecting-systems

  10. Where Did This Request Come From?

    The Sec-Fetch-Site, -Mode, -Dest and -User headers answer a question servers could never ask — and turn a class of cross-site attacks into a four-line check.

    security csp http web browsers csrf cookies hsts dissecting-systems

  11. Trust No Script

    Why a strict Content Security Policy is one of the hardest headers to deploy — and how to read one with Google's CSP Evaluator.

    security csp web xss browsers gen-ai dissecting-systems

2009

  1. Making the browser download scripts in parallel

    Loading multiple scripts concurrently instead of the browser’s serial default.

    javascript performance browsers archive