Headers, cookies & policies
Technical guides about headers, cookies & policies, written for practical follow-up.
Guides in this topic
7 articlesAudit security headers across redirects, errors and authenticated pages
Build a response matrix that catches missing middleware, stale edge policies and differences between public and signed-in responses.
Build a CSP rollout around nonces and actual application flows
Move from a dependency inventory to report-only observation and enforcement, with concrete nonce and reporting decisions.
Session cookies: scope, SameSite and prefix rules
Choose attributes that fit login and payment flows, then check what the browser actually accepts and sends.
Referrer-Policy: decide which navigation details leave your site
Compare origin and full-URL disclosure across request types, and test policies where redirects and subresources complicate the picture.
Permissions Policy for embedded camera and microphone features
Debug feature access across top-level headers, iframe allow attributes, user permission and secure contexts.
Debug CORS preflights and credentialed requests
Trace a browser request from Origin through OPTIONS and the actual response, including cache and credential failures.
Security headers that earn their place.
A practical way to improve response policies while preserving login, checkout and the integrations your site actually needs.
No guides match that search.
7 guides