Web Platform · Cluster
Web Security Model
Origins, CSP, and cross-site boundaries.
- 01 How the Same-Origin Policy Computes and Compares Origins The origin triple of scheme, host, and port, the opaque origins produced by sandboxing and data URLs, and which browser capabilities the policy actually gates.
- 02 Cookie Scoping, SameSite, and the Site Boundary How cookies are addressed by host and path rather than of origin, what SameSite Lax and Strict actually permit, and where domain-scoped cookies leak across unrelated applications.
- 03 CORS Preflight, Credentials, and the Response Sharing Rules The request classifications that decide whether a preflight happens, what the OPTIONS exchange negotiates, and why credentialed CORS forbids the wildcard origin.
- 04 Content Security Policy: Source Lists, Nonces, and Trust Propagation How CSP directives fall back to default-src, why host allowlists leak through JSONP and open redirects, and how nonces plus strict-dynamic move script trust to runtime provenance.
- 05 Cross-Origin Isolation with COOP and COEP How Cross-Origin-Opener-Policy and Cross-Origin-Embedder-Policy combine to produce crossOriginIsolated documents, and what CORP must do on the other side of each load.
- 06 CSRF Defence: Synchronizer Tokens, Fetch Metadata, and SameSite Why ambient credentials make state-changing requests forgeable, what a synchronizer token must be bound to, and how Sec-Fetch-Site lets a server reject cross-site writes without per-form state.
- 07 Sandboxed Frames and the postMessage Trust Boundary Which capabilities the sandbox attribute strips and which tokens restore them, why allow-scripts with allow-same-origin defeats the frame, and how to validate a message without racing a navigation.
- 08 Subresource Integrity and the Trust Chain for Third-Party Scripts How the integrity attribute verifies fetched bytes, why cross-origin scripts need CORS for the check to run, and what hash pinning does and does not protect against.
- 09 Trusted Types and the Typing of DOM XSS Sinks How require-trusted-types-for turns string assignment into a checked operation, what a policy must do beyond returning its input, and how the enforcement spreads across a codebase without freezing releases.
- 10 Spectre, Site Isolation, and the Limits of the Origin Boundary Why speculative execution made the origin a weaker boundary than it appears, how process-per-site and response blocking reduce the exposure, and which timing channels remain open.