Headers, cookies & policies
Technical guides about headers, cookies & policies, written for practical follow-up.
Guides in this topic
7 articlesYour homepage headers pass. What happens on a redirect or an error?
Build a small response matrix that tests security policies across the routes and status codes users actually receive.
A CSP nonce must change with the response, not with the deployment
Inspect nonce generation, caching and report-only observations while introducing CSP to a real application.
A login cookie is set but the next request omits it. Check the scope
Use Domain, Path, Secure and SameSite evidence to explain a session cookie that behaves differently across requests.
A campaign URL carries private details. Check what the referrer reveals
Compare full-URL, origin-only and omitted referrers for the navigation and subresource requests that matter.
The embed asks for a camera, but the parent page never delegated it
Trace feature delegation through the top-level header, iframe policy and user permission for embedded media.
OPTIONS succeeded. Why did the browser still reject the API response?
Inspect preflight and actual-response headers together for credentialed and cross-origin API requests.
Introduce browser security policies around the flows you cannot break
Plan staged policy changes for login, embeds and third-party dependencies, with response-level verification.
No guides match that search.
7 guides