Notes tagged “csp”

2026

1. July 2026 The Header That Can't Be Cached

   Cache-Control from first principles — and why a page carrying a CSP nonce must be told never to be stored, not merely "don't cache."

   security csp http caching web dissecting-systems

2. July 2026 Trust No Script

   Why a strict Content Security Policy is one of the hardest headers to deploy — and how to read a real one with Google's CSP Evaluator.

   security csp web xss browsers dissecting-systems

3. July 2026 Can I Use This Library?

   A strict CSP quietly turns every dependency into a security decision. Here is the tree I walk to make it — per library, and across a whole app.

   security csp web architecture dependencies dissecting-systems