Browse 2 notes tagged web security.

#web security

CORS from scratch: separate request delivery, cookies, and response access

A practical guide to origins, OPTIONS preflights, fetch credentials, cookies, Allow and Expose headers, and browser debugging. Understand why an API can finish while JavaScript cannot read its response.

#CORS#Fetch API#HTTP+2

2026-10-09

Don't block first: use CSP Report-Only to find real dependencies, then tighten safely

CSP Report-Only is not a pause in security. It reveals real dependencies, noise, and legacy code patterns before a nonce-, hash-, and least-privilege policy reaches production.

#CSP#Content Security Policy#web security+2

2026-09-04