You're viewing the readable version of this site. The interactive extras (search, diagrams, read-aloud) need JavaScript and a current browser. Enable JavaScript; if it is already enabled, update your browser.

Tag

Notes tagged “http”

Every note filed under http, newest first.

A filtered view of the notes.

2026

  1. HSTS: It's Time to Go HTTPS-Only

    The header that makes HTTPS non-negotiable — no SSL stripping, no click-through, no fast rollback. Turn it on. Then think carefully before you preload, because that part you cannot take back.

    security http tls hsts web browsers privacy dissecting-systems

  2. Nobody Shares Your Address Space

    COOP, COEP and CORP are presented as three related headers. They are three doors into one process — and Spectre is why the browser cares who is inside it, not just what they are allowed to read.

    security http web browsers spectre isolation dissecting-systems

  3. The Credential That Predates the Origin

    Cookies do not obey the same-origin policy — they never have. Thirty years of attributes, flags and name prefixes are one long retrofit, and knowing which parts actually hold is most of session security.

    security web cookies sessions http browsers dissecting-systems

  4. The Header That Grants Nothing

    CORS does not protect your server. It relaxes a rule about who may read a reply — and almost every misconfiguration comes from believing it does the opposite.

    security web cors http browsers caching dissecting-systems

  5. Why Your Progressive Approach to Web Security Fails

    Adding a security header can only tighten what reaches the browser; nothing you add can loosen it. Loosening is a hand edit of the policy already shipped — and that asymmetry is why incremental hardening degenerates into permissive sprawl, and why deny-by-default with a report-only rollout is the only shape that survives a real application.

    security csp http web browsers architecture dissecting-systems

  6. Where Did This Request Come From?

    The Sec-Fetch-Site, -Mode, -Dest and -User headers answer a question servers could never ask — and turn a class of cross-site attacks into a four-line check.

    security csp http web browsers csrf cookies hsts dissecting-systems

  7. The URL Is the Hash

    Content-addressing on the wire — how the web quietly became a content-addressed store, where fingerprinted URLs and Subresource Integrity are real Merkle edges and the cache that looks most like one isn't.

    http caching content-addressing subresource-integrity merkle cdn web-performance security dissecting-systems

  8. The Header That Can't Be Cached

    Cache-Control from first principles — and why a page carrying a CSP nonce must be told never to be stored, not merely "don't cache."

    security csp http caching web dissecting-systems