You're viewing the readable version of this site. The interactive extras (search, diagrams, read-aloud) need JavaScript and a current browser. Enable JavaScript; if it is already enabled, update your browser.

Tag

Notes tagged “csp”

Every note filed under csp, newest first.

A filtered view of the notes.

2026

  1. Code From Strangers

    A map of web security before the deep dives — one asymmetry that explains every attack, five questions the mechanisms answer, and the vocabulary you need so none of the rest reads as noise.

    security web browsers same-origin-policy csp standards dissecting-systems

  2. Strings Do Not Remember Where They Came From

    Trusted Types does not make XSS impossible — the spec says so itself. It makes unreviewed assignment impossible, which is a smaller claim and a far more useful one.

    security web xss trusted-types csp browsers types dissecting-systems

  3. Why Your Progressive Approach to Web Security Fails

    Adding a security header can only tighten what reaches the browser; nothing you add can loosen it. Loosening is a hand edit of the policy already shipped — and that asymmetry is why incremental hardening degenerates into permissive sprawl, and why deny-by-default with a report-only rollout is the only shape that survives a real application.

    security csp http web browsers architecture dissecting-systems

  4. The Good, the Bad, and the Bugly

    When browser bisection almost works—and why stopping can be the right result.

    browsers accessibility csp security debugging art-of-debugging dissecting-systems

  5. Where Did This Request Come From?

    The Sec-Fetch-Site, -Mode, -Dest and -User headers answer a question servers could never ask — and turn a class of cross-site attacks into a four-line check.

    security csp http web browsers csrf cookies hsts dissecting-systems

  6. Can I Use This Library?

    A strict CSP quietly turns every dependency into a security decision. Here is the tree I walk to make it — per library, and across a whole app.

    security csp web architecture dependencies dissecting-systems

  7. The Header That Can't Be Cached

    Cache-Control from first principles — and why a page carrying a CSP nonce must be told never to be stored, not merely "don't cache."

    security csp http caching web dissecting-systems

  8. Trust No Script

    Why a strict Content Security Policy is one of the hardest headers to deploy — and how to read one with Google's CSP Evaluator.

    security csp web xss browsers gen-ai dissecting-systems