Hardening KrakenJS Applications with Helmet and Content Security Policy
Learn how to mitigate XSS risks in KrakenJS by implementing a strict Content Security Policy (CSP) using Helmet middleware and dynamic nonces.
Loading…
ReadMeFeed / Community knowledge
#web-security
Real questions. Useful conversations. Find the people who know your stack.
krakenjsCodePen Embedded Pens: Architecture, Isolation Guarantees, and Operational Verification
An architecture note on CodePen's Embedded Pens: the minimal stateless design, sandbox and CSP trust boundaries, operational verification steps, failure modes, and design change triggers that would require re-evaluating isolation guarantees.
codepenSecuring Public Clients: Why PKCE is the New Standard for OAuth 2.0
Public clients can't keep secrets. Learn how PKCE (Proof Key for Code Exchange) secures OAuth 2.0 flows for SPAs and mobile apps by replacing static secrets with dynamic, one-time verifiers.
Flask's Session Is a Cookie, Not a Vault: Designing Logins Around That Fact
Flask's session is a signed cookie, not a server-side store. Here's what that means for login code, secret rotation, revocation, and when to move to Redis-backed sessions.
pythonFirefox's Enhanced Tracking Protection: Blocking Trackers Without Breaking Sites
Firefox's Enhanced Tracking Protection blocks known trackers by default, but aggressive blocking can break websites. The real challenge is maintaining privacy without sacrificing functionality.
firefoxChoosing the Right SameSite Value for Cross-Site Cookies in Chrome
A decision guide for picking SameSite=Lax, Strict, or None for cross-site cookies in Chrome, with a comparison table, explicit Set-Cookie examples, and DevTools validation steps.
chromeDjango CSRF Protection: An Architecture Note on Requirements, Boundaries, and Failure Modes
An architecture note on Django's CSRF middleware: what it must guarantee, the minimal session-backed token design, the trust boundaries, operational checks, and failure modes.
djangoExposing Secure Post Meta via Custom WordPress REST API Endpoints
Learn how to create a secure custom WordPress REST API endpoint to expose specific post meta data only to authorized users, preventing sensitive data leaks.
Choosing a SameSite Cookie Policy in Chrome: Lax, Strict, or None
Chrome defaults cookies to SameSite=Lax. This guide compares Lax, Strict, and None; Secure, explaining the CSRF trade-offs and how to verify cookie attributes in DevTools.