You're viewing the readable version of this site. The interactive extras (search, diagrams, read-aloud) need JavaScript and a current browser. Enable JavaScript; if it is already enabled, update your browser.

Tag

Notes tagged “cookies”

Every note filed under cookies, newest first.

A filtered view of the notes.

2026

  1. The Credential That Predates the Origin

    Cookies do not obey the same-origin policy — they never have. Thirty years of attributes, flags and name prefixes are one long retrofit, and knowing which parts actually hold is most of session security.

    security web cookies sessions http browsers dissecting-systems

  2. Where Did This Request Come From?

    The Sec-Fetch-Site, -Mode, -Dest and -User headers answer a question servers could never ask — and turn a class of cross-site attacks into a four-line check.

    security csp http web browsers csrf cookies hsts dissecting-systems