Add Observatory docs to MDN #33793

chrisdavidmills · 2024-05-28T13:14:50Z

Description

Mozilla Observatory is being moved to MDN. This PR adds the accompanying cheat sheet docs to MDN, and restructures the existing security docs to make space for them.

Motivation

Additional details

See mdn/mdn#548 for the MDN project tracking item.

Related issues and pull requests

Updating the HTTP sidebar links to point to the updated Observatory and docs locations: [DON'T MERGE YET] Update Observatory links in HTTPsidebar yari#11236

files/en-us/web/security/index.md

github-actions · 2024-05-28T13:16:31Z

Preview URLs (19 pages)

Flaws (7)

Note! 13 documents with no flaws that don't need to be listed. 🎉

URL: /en-US/docs/Learn/Server-side/Apache_Configuration_htaccess
Title: Apache Configuration: .htaccess
Flaw count: 1

broken_links:
- Can't resolve /en-US/observatory/

URL: /en-US/docs/Web/Security
Title: Security on the web
Flaw count: 2

broken_links:
- Can't resolve /en-US/docs/Web/Security/Mixed_content/How_to_fix_website_with_mixed_content
- Can't resolve /en-US/observatory/

URL: /en-US/docs/Web/Security/Practical_implementation_guides
Title: Practical security implementation guides
Flaw count: 1

broken_links:
- Can't resolve /en-US/observatory/

URL: /en-US/docs/Web/Security/Practical_implementation_guides/TLS
Title: Transport Layer Security (TLS) configuration
Flaw count: 1

broken_links:
- Can't resolve /en-US/docs/Web/Security/Mixed_content/How_to_fix_website_with_mixed_content

URL: /en-US/docs/Web/Security/Transport_Layer_Security
Title: Transport Layer Security
Flaw count: 1

broken_links:
- Can't resolve /en-US/observatory/

URL: /en-US/docs/Web/HTTP/Headers/X-Content-Type-Options
Title: X-Content-Type-Options
Flaw count: 1

broken_links:
- Can't resolve /en-US/observatory/

External URLs (25)

URL: /en-US/docs/Web/Security
Title: Security on the web

https://blog.mozilla.org/security/ (1 time) (Note! This may be a new URL 👀)
https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html (1 time) (Note! This may be a new URL 👀)
https://cheatsheetseries.owasp.org/index.html (1 time) (Note! This may be a new URL 👀)
https://en.wikipedia.org/wiki/Man-in-the-middle_attack (1 time) (Note! This may be a new URL 👀)
https://owasp.org/www-community/vulnerabilities/Information_exposure_through_query_strings_in_url (1 time) (Note! This may be a new URL 👀)
https://web.archive.org/ (1 time) (Note! This may be a new URL 👀)

URL: /en-US/docs/Web/Security/Practical_implementation_guides
Title: Practical security implementation guides

https://cheatsheetseries.owasp.org/ (1 time) (Note! This may be a new URL 👀)
https://owasp.org/www-community/attacks/ (1 time) (Note! This may be a new URL 👀)

URL: /en-US/docs/Web/Security/Practical_implementation_guides/CSRF_prevention
Title: Cross-site request forgery (CSRF) prevention

https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html (1 time) (Note! This may be a new URL 👀)
https://en.wikipedia.org/wiki/Cross-site_request_forgery (1 time) (Note! This may be a new URL 👀)

URL: /en-US/docs/Web/Security/Practical_implementation_guides/CSP
Title: Content Security Policy (CSP) implementation

https://csp-evaluator.withgoogle.com/ (1 time) (Note! This may be a new URL 👀)

URL: /en-US/docs/Web/Security/Practical_implementation_guides/Clickjacking
Title: Clickjacking prevention

https://auth0.com/blog/preventing-clickjacking-attacks/ (1 time) (Note! This may be a new URL 👀)
https://cheatsheetseries.owasp.org/cheatsheets/Clickjacking_Defense_Cheat_Sheet.html (2 times) (Note! This may be a new URL 👀)

URL: /en-US/docs/Web/Security/Practical_implementation_guides/Cookies
Title: Secure cookie configuration

https://datatracker.ietf.org/doc/html/rfc6265 (1 time) (Note! This may be a new URL 👀)

URL: /en-US/docs/Web/Security/Practical_implementation_guides/TLS
Title: Transport Layer Security (TLS) configuration

https://en.wikipedia.org/wiki/Downgrade_attack (1 time) (Note! This may be a new URL 👀)
https://example.com/ (3 times) (Note! This may be a new URL 👀)
https://example.org/ (1 time) (Note! This may be a new URL 👀)
https://hstspreload.org/ (2 times) (Note! This may be a new URL 👀)
https://ssl-config.mozilla.org/ (1 time) (Note! This may be a new URL 👀)
https://wiki.mozilla.org/Security/Server_Side_TLS (1 time) (Note! This may be a new URL 👀)

URL: /en-US/docs/Web/Security/Practical_implementation_guides/Robots_txt
Title: robots.txt configuration

https://www.robotstxt.org/robotstxt.html (1 time) (Note! This may be a new URL 👀)

URL: /en-US/docs/Web/Security/Practical_implementation_guides/SRI
Title: Subresource integrity (SRI) implementation

https://www.srihash.org/ (1 time) (Note! This may be a new URL 👀)

URL: /en-US/docs/Web/Security/Practical_implementation_guides/Turning_off_form_autocompletion
Title: How to turn off form autocompletion

https://www.w3.org/WAI/WCAG21/Understanding/identify-input-purpose.html (1 time) (Note! This may be a new URL 👀)

URL: /en-US/docs/Web/Security/Practical_implementation_guides/CORS
Title: Cross-Origin Resource Sharing (CORS) configuration

https://w3c.github.io/webappsec-cors-for-developers/ (1 time) (Note! This may be a new URL 👀)

URL: /en-US/docs/Web/Security/Transport_Layer_Security
Title: Transport Layer Security

https://www.ssllabs.com/ssltest/ (1 time) (Note! This may be a new URL 👀)

(comment last updated: 2024-06-18 13:47:51)

…ion guide

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

files/en-us/web/security/index.md

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

…lls/content into add-observatory-docs-to-mdn

files/en-us/web/security/practical_implementation/clickjacking/index.md

files/en-us/web/security/practical_implementation/cookies/index.md

files/en-us/web/security/practical_implementation/referrer_policy/index.md

files/en-us/web/security/practical_implementation/sri/index.md

files/en-us/web/security/practical_implementation/tls/index.md

…/index.md Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

…x.md Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

…/index.md Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

…x.md Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

…icy/index.md Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

Tibap · 2024-06-13T17:30:20Z

files/en-us/web/security/practical_implementation_guides/csrf_prevention/index.md

+
+You are advised to use both strategies for websites that allow destructive changes such as account deletion. Anti-CRSF tokens are arguably unnecessary for other sites, although it is still advised to have `SameSite` set to a non-`None` value to help protect the user's [Privacy](/en-US/docs/Web/Privacy).
+
+Most application frameworks have built-in CSRF tokenization to ease implementation.


I would add something like: "Make sure to check if your application frameworks have built-in CSRF protections. If that is the case, always use these and don't try to re-invent the wheel."

Good idea. I ended up modifying the paragraph to:

Most application frameworks have built-in CSRF tokenization to ease implementation. Make sure to choose one that does, and don't try to reinvent the wheel.

Tibap · 2024-06-13T17:31:04Z

files/en-us/web/security/practical_implementation_guides/csrf_prevention/index.md

+- `None`
+ - : Specifies that cookies are sent on both originating and cross-site requests.
+
+You should set the strongest `SameSite` level that you can for your site to still work. Ideally never set `None` unless you really need to. Bear in mind that `Lax` is the default value if the header is not specified.


The OWASP cheatsheets are warning users when using SameSite cookies: “SameSite Cookie Attribute can be used for session cookies but be careful to NOT set a cookie specifically for a domain. This action introduces a security vulnerability because all subdomains of that domain will share the cookie, and this is particularly an issue if a subdomain has a CNAME to domains not in your control”. Should we integrate a similar warning in our doc as well?

I started writing a note about it, and ended up with this:

Note: SameSite can be used for session cookies but DO NOT set a cookie across an entire domain. This introduces a security vulnerability because all subdomains of that domain will share the cookie. This is particularly an issue if a subdomain has a CNAME to domains not under your control.

But I'm not really sure I understand the logic behind it. Is this an issue only with setting SameSite cookies, and if so, why does SameSite cause this additional vulnerability? Or is it an issue with cookies in general, in which case might belong on the secure cookies page instead.

This was more a question than a suggestion so I agree, I don't see the value of this warning in that context! No need to change anything, thanks!

Tibap · 2024-06-13T17:37:13Z

files/en-us/web/security/practical_implementation_guides/clickjacking/index.md

+
+[Clickjacking](/en-US/docs/Glossary/Clickjacking) is an attack whereby malicious sites trick users into clicking links or UI elements by making them appear like a trusted site the user is familiar with. This is usually done by embedding part or all of the trusted site into the malicious site via an `<iframe>`. A button, link, or other UI feature is then positioned on top of that content to make the user think they are interacting with their trusted site, when in fact they are interacting with the malicious site.
+
+## Solution


For Clickjacking attacks that rely on the victim to be authenticated, another protection is to make sure SameSite cookies are set.

Makes sense. I've added information about it on this page, and the secure cookies page.

Tibap · 2024-06-13T17:37:48Z

files/en-us/web/security/practical_implementation_guides/clickjacking/index.md

+
+[Clickjacking](/en-US/docs/Glossary/Clickjacking) is an attack whereby malicious sites trick users into clicking links or UI elements by making them appear like a trusted site the user is familiar with. This is usually done by embedding part or all of the trusted site into the malicious site via an `<iframe>`. A button, link, or other UI feature is then positioned on top of that content to make the user think they are interacting with their trusted site, when in fact they are interacting with the malicious site.
+
+## Solution


We should add a window.confirm() protection option as well: https://cheatsheetseries.owasp.org/cheatsheets/Clickjacking_Defense_Cheat_Sheet.html#windowconfirm-protection

I've added mention of it to the bottom paragraph, as it is relevant there.

Tibap · 2024-06-13T17:38:37Z

files/en-us/web/security/practical_implementation_guides/clickjacking/index.md

+Content-Security-Policy: frame-ancestors https://example.org
+# Block embedding in browsers that don't support CSP2
+X-Frame-Options: DENY
+```


Let's add a “See also” section with the following links:

https://cheatsheetseries.owasp.org/cheatsheets/Clickjacking_Defense_Cheat_Sheet.html

https://auth0.com/blog/preventing-clickjacking-attacks/https://auth0.com/blog/preventing-clickjacking-attacks/

Good recommendations, thanks! Added in next commit.

dipikabh · 2024-06-13T17:40:54Z

files/en-us/web/security/practical_implementation_guides/index.md

+| [TLS configuration](/en-US/docs/Web/Security/Practical_implementation_guides/TLS#tls_configuration) | Medium | Medium | Yes | Use the most secure [Transport Layer Security](/en-US/docs/Glossary/TLS) (TLS) configuration available for your user base. |
+| [Resource loading](/en-US/docs/Web/Security/Practical_implementation_guides/TLS#resource_loading) | Maximum | Low | Yes | Load both passive and active resources via HTTPS. |
+| [HTTP redirection](/en-US/docs/Web/Security/Practical_implementation_guides/TLS#http_redirections) | Maximum | Low | Yes | Websites must redirect to HTTPS; API endpoints should disable HTTP entirely. |
+| [HSTS implementation](/en-US/docs/Web/Security/Practical_implementation_guides/TLS#http_strict_transport_security_implementation) | High | Low | Yes | Notify user agents to connect to sites only over HTTPS, even if the original scheme chosen was HTTP, using HTTP Strict transport security (HSTS). |


I saw your previous comment about this one. WDYT about:

Suggested change

| [HSTS implementation](/en-US/docs/Web/Security/Practical_implementation_guides/TLS#http_strict_transport_security_implementation) | High | Low | Yes | Notify user agents to connect to sites only over HTTPS, even if the original scheme chosen was HTTP, using HTTP Strict transport security (HSTS). |

| [HSTS implementation](/en-US/docs/Web/Security/Practical_implementation_guides/TLS#http_strict_transport_security_implementation) | High | Low | Yes | Use HTTP Strict transport security (HSTS) to notify browsers to connect to sites only over HTTPS, even if the original scheme chosen was HTTP. |

I know your version is strictly speaking more grammatically correct, but "... to ... to ... to ..." is a bit horrible to read.

Ah, didn't notice the close proximity of "to"s but doesn't seem too bad to me readability-wise

files/en-us/web/security/practical_implementation_guides/clickjacking/index.md

files/en-us/web/security/practical_implementation_guides/cookies/index.md

files/en-us/web/security/practical_implementation_guides/cors/index.md

dipikabh · 2024-06-13T19:01:39Z

files/en-us/web/security/practical_implementation/index.md

+
+The guides are listed in the order that we recommend they are implemented. This order is based on a combination of security impact and ease of implementation from an operational and developmental perspective.
+
+| Guide | Impact | Difficulty | Required | Summary |


My preference is to use only the acronym in the sidebar (short-title) and the expanded title on the page, so:

title: Cross-Origin Resource Sharing (CORS) configuration short-title: CORS configuration

One of the things this can help with is that when you're on the landing page, you can quickly match up the guides from the table's first column to those in the sidebar. At the moment, you need to parse the titles in the sidebar a bit.

With both the expanded form and acronym in the page title, the page will still be searchable in the "Quick Search" field using either the long form or acronym.

But I'll leave it to you to make the call. The glossary pages have acronyms in the sidebar - I don't know if we have a strict guideline or any guideline around this.

dipikabh

Going over some of the updates

github-actions · 2024-06-13T23:06:58Z

This pull request has merge conflicts that must be resolved before it can be merged.

chrisdavidmills · 2024-06-14T13:40:40Z

My preference is to use only the acronym in the sidebar (short-title) and the expanded title on the page, so:

@dipikabh the problem with this is that short titles don't work with this type of sidebar (I think they only work in API sidebars). I tried this out the first time around when I noticed the titles were a bit long in the sidebar.

files/en-us/web/security/practical_implementation_guides/csrf_prevention/index.md

files/en-us/web/security/practical_implementation_guides/index.md

files/en-us/web/security/practical_implementation_guides/tls/index.md

…prevention/index.md Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

…ndex.md Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

files/en-us/web/security/practical_implementation_guides/csp/index.md

files/en-us/web/security/practical_implementation_guides/robots_txt/index.md

files/en-us/web/security/practical_implementation_guides/tls/index.md

dipikabh · 2024-06-17T20:37:53Z

files/en-us/web/security/practical_implementation_guides/index.md

+| [TLS configuration](/en-US/docs/Web/Security/Practical_implementation_guides/TLS#tls_configuration) | Medium | Medium | Yes | Use the most secure [Transport Layer Security](/en-US/docs/Glossary/TLS) (TLS) configuration available for your user base. |
+| [Resource loading](/en-US/docs/Web/Security/Practical_implementation_guides/TLS#resource_loading) | Maximum | Low | Yes | Load both passive and active resources via HTTPS. |
+| [HTTP redirection](/en-US/docs/Web/Security/Practical_implementation_guides/TLS#http_redirections) | Maximum | Low | Yes | Websites must redirect to HTTPS; API endpoints should disable HTTP entirely. |
+| [HSTS implementation](/en-US/docs/Web/Security/Practical_implementation_guides/TLS#http_strict_transport_security_implementation) | High | Low | Yes | Notify user agents to connect to sites only over HTTPS, even if the original scheme chosen was HTTP, using HTTP Strict transport security (HSTS). |


Ah, didn't notice the close proximity of "to"s but doesn't seem too bad to me readability-wise

dipikabh

Preview pages for the last few files did not update, I am guessing because of an incomplete check (check-redirects).
I'm going by your updates/responses and the overall content is looking in good shape. Leaving my +1 here. Let me know if you need me to check anything again. Thanks @chrisdavidmills!

dipikabh

Some links might need to be updated

files/en-us/web/html/attributes/autocomplete/index.md

files/en-us/web/html/element/form/index.md

dipikabh · 2024-06-18T16:57:28Z

files/en-us/web/security/practical_implementation_guides/robots_txt/index.md

+Use `robots.txt` to reduce website load and stop unsuitable content appearing in search results.
+
+Using `robots.txt` is optional and sites should use it only for these purposes. It should not be used as a way to prevent the disclosure of private information or to hide portions of a website. While using this file can prevent these sites from appearing in search engine results, it does not secure websites against attackers who can still determine such details because `robots.txt` is publicly accessible.


Nit: WDYT about moving around the sentences a bit. The part that it doesn't secure websites should stand out on it's own, possibly can even be highlighted as a note.

Suggested change

Use `robots.txt` to reduce website load and stop unsuitable content appearing in search results.

Using `robots.txt` is optional and sites should use it only for these purposes. It should not be used as a way to prevent the disclosure of private information or to hide portions of a website. While using this file can prevent these sites from appearing in search engine results, it does not secure websites against attackers who can still determine such details because `robots.txt` is publicly accessible.

Use `robots.txt` to reduce website load and stop unsuitable content appearing in search results. Using this file is optional and sites should use it only for these purposes. Don't use `robots.txt` as a way to prevent the disclosure of private information or to hide portions of a website.

While using this file can prevent these sites from appearing in search engine results, it does not secure websites against attackers who can still determine such details because `robots.txt` is publicly accessible.

dipikabh · 2024-06-18T17:00:06Z

files/en-us/web/security/practical_implementation_guides/robots_txt/index.md

+
+## See also
+
+- [About /robots.txt](https://www.robotstxt.org/robotstxt.html) on `robotstxt.org`.


Suggested change

- [About /robots.txt](https://www.robotstxt.org/robotstxt.html) on `robotstxt.org`.

- [About /robots.txt](https://www.robotstxt.org/robotstxt.html) on `robotstxt.org`

gene1wood · 2024-06-18T17:54:41Z

files/en-us/web/security/practical_implementation_guides/cookies/index.md

+- `Domain`
+ - : Cookies should only have a `Domain` set if they need to be accessible on other domains; this should be set to the most restrictive domain possible.
+- `Path`
+ - : Cookies should be set to the most restrictive `Path` possible; for most applications, this will be set to the root directory.


Suggested change

- : Cookies should be set to the most restrictive `Path` possible; for most applications, this will be set to the root directory.

- : Cookies should be set to the most restrictive `Path` possible.

This line is a bit confusing as it starts by saying to set Path to the most restrictive value, but then follows by saying that most of the time it's set to the root directory which is the least restrictive value.

gene1wood · 2024-06-18T17:56:11Z

files/en-us/web/security/practical_implementation_guides/cookies/index.md

+
+## Problem
+
+Cookies often contain session identifiers or other sensitive information. Unwanted access to cookies, therefore, can cause a host of problems, including [privacy](/en-US/docs/Web/Privacy) issues, ({{Glossary("Cross-site_scripting", "Cross-site scripting (XSS)")}}) attacks, Cross-site request forgery ([CSRF](/en-US/docs/Glossary/CSRF)) attacks, and more.


This phrase

Unwanted access to cookies, therefore, can cause a host of problem

is confusing to me. Maybe change Unwanted to Unauthorized?

gene1wood · 2024-06-18T17:56:52Z

files/en-us/web/security/practical_implementation_guides/cookies/index.md

+- `Path`
+ - : Cookies should be set to the most restrictive `Path` possible; for most applications, this will be set to the root directory.
+- `SameSite`
+ - : Forbid sending the cookie via cross-origin requests (for example from {{htmlelement("img")}} element), as a strong [anti-CSRF](/en-US/docs/Web/Security/Practical_implementation_guides/CSRF_prevention) measure. `SameSite` is also useful in protecting against [Clickjacking](/en-US/docs/Glossary/Clickjacking) attacks, in cases that rely on the user being authenticated. You should use one of the following two values:


Suggested change

- : Forbid sending the cookie via cross-origin requests (for example from {{htmlelement("img")}} element), as a strong [anti-CSRF](/en-US/docs/Web/Security/Practical_implementation_guides/CSRF_prevention) measure. `SameSite` is also useful in protecting against [Clickjacking](/en-US/docs/Glossary/Clickjacking) attacks, in cases that rely on the user being authenticated. You should use one of the following two values:

- : Forbid sending the cookie via cross-origin requests (for example from an {{htmlelement("img")}} element), as a strong [anti-CSRF](/en-US/docs/Web/Security/Practical_implementation_guides/CSRF_prevention) measure by setting `SameSite` to `Strict`. `SameSite` is also useful in protecting against [Clickjacking](/en-US/docs/Glossary/Clickjacking) attacks, in cases that rely on the user being authenticated. You should use one of the following two values:

gene1wood · 2024-06-18T18:11:38Z

files/en-us/web/security/practical_implementation_guides/robots_txt/index.md

+Disallow: /
+```
+
+Hide certain directories (this is not recommended):


Can we add details as to why it's bad to hide certain directories from a crawler but not the entire site? I don't know the "why" behind this.

gene1wood · 2024-06-18T18:13:12Z

files/en-us/web/security/practical_implementation_guides/sri/index.md

+
+## Problem
+
+Attackers can modify the contents of JavaScript libraries hosted on content delivery networks (CDNs), creating vulnerabilities in all websites that use these libraries.


Suggested change

Attackers can modify the contents of JavaScript libraries hosted on content delivery networks (CDNs), creating vulnerabilities in all websites that use these libraries.

If an attacker exploited a content delivery network (CDN) and modified the contents of JavaScript libraries hosted on that CDN, it would create vulnerabilities in all websites that use those libraries.

gene1wood · 2024-06-18T22:36:05Z

files/en-us/web/security/practical_implementation_guides/tls/index.md

+
+### Solution
+
+HTTP [`Strict-Transport-Security`](/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security) (HSTS) is an HTTP header that notifies browsers to connect to a given site only over HTTPS, even if the originally specified scheme was HTTP. Browsers with HSTS set for a given site will automatically upgrade all requests to HTTPS. HSTS also tells browsers to treat TLS and certificate-related errors more strictly by disabling the ability to bypass the error page.


Suggested change

HTTP [`Strict-Transport-Security`](/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security) (HSTS) is an HTTP header that notifies browsers to connect to a given site only over HTTPS, even if the originally specified scheme was HTTP. Browsers with HSTS set for a given site will automatically upgrade all requests to HTTPS. HSTS also tells browsers to treat TLS and certificate-related errors more strictly by disabling the ability to bypass the error page.

HTTP [`Strict-Transport-Security`](/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security) (HSTS) is an HTTP header that notifies browsers to connect to a given site only over HTTPS, even if the originally specified scheme was HTTP. Browsers with HSTS set for a given site will automatically upgrade all requests to HTTPS for that site. HSTS also tells browsers to treat TLS and certificate-related errors more strictly by disabling the ability to bypass the certificate error page.

gene1wood · 2024-06-18T22:36:51Z

files/en-us/web/security/practical_implementation_guides/tls/index.md

+- `max-age`
+ - : Sets the duration, in seconds, for which browsers will redirect to HTTPS.
+- `includeSubDomains` {{optional_inline}}
+ - : Specifies whether browsers should upgrade requests on all subdomains to HTTPS. For example, setting `includeSubDomains` on `domain.example.com` will ensure that requests to `host1.domain.example.com` and `host2.domain.example.com` are upgraded.


Suggested change

- : Specifies whether browsers should upgrade requests on all subdomains to HTTPS. For example, setting `includeSubDomains` on `domain.example.com` will ensure that requests to `host1.domain.example.com` and `host2.domain.example.com` are upgraded.

- : Specifies whether browsers should upgrade requests on all subdomains to HTTPS. For example, setting `includeSubDomains` on `domain.example.com` will ensure that requests to `host1.domain.example.com` and `host2.domain.example.com` are also upgraded in addition to `domain.example.com`.

gene1wood · 2024-06-18T22:40:04Z

files/en-us/web/security/practical_implementation_guides/tls/index.md

+- `includeSubDomains` {{optional_inline}}
+ - : Specifies whether browsers should upgrade requests on all subdomains to HTTPS. For example, setting `includeSubDomains` on `domain.example.com` will ensure that requests to `host1.domain.example.com` and `host2.domain.example.com` are upgraded.
+- `preload` {{optional_inline}}
+ - : Specifies whether the site should be preloaded. Including this directive means your site will be included in the [HSTS preload list](https://hstspreload.org/).


Suggested change

- : Specifies whether the site should be preloaded. Including this directive means your site will be included in the [HSTS preload list](https://hstspreload.org/).

- : Specifies whether the site should be preloaded. Including this directive means your site can be included in the [HSTS preload list](https://hstspreload.org/).

gene1wood · 2024-06-18T22:42:54Z

files/en-us/web/security/practical_implementation_guides/tls/index.md

+
+1. Set a `max-age` value of at least six months (`15768000`). Longer periods, such as two years (`63072000`), are recommended. Once this value is set, the site must continue to support HTTPS until the expiry time is reached.
+2. If possible, set `includeSubDomains` to improve security on all subdomains. Careful testing is needed when setting this directive because it could disable sites on subdomains that don't yet have HTTPS enabled.
+3. If possible, set `preload` to include your website in the [HSTS preload list](https://hstspreload.org/). Web browsers will perform HTTPS upgrades to preloaded sites before receiving the initial `Strict-Transport-Security` header. This prevents [downgrade attacks](https://en.wikipedia.org/wiki/Downgrade_attack) upon first use and is recommended for all high-risk websites. Note that being included in the HSTS preload list also requires `includeSubDomains` to be set and `max-age` to be set to a minimum of 1 year (`31536000`).


Suggested change

3. If possible, set `preload` to include your website in the [HSTS preload list](https://hstspreload.org/). Web browsers will perform HTTPS upgrades to preloaded sites before receiving the initial `Strict-Transport-Security` header. This prevents [downgrade attacks](https://en.wikipedia.org/wiki/Downgrade_attack) upon first use and is recommended for all high-risk websites. Note that being included in the HSTS preload list also requires `includeSubDomains` to be set and `max-age` to be set to a minimum of 1 year (`31536000`).

3. If possible, set `preload` to make it possible to include your website in the [HSTS preload list](https://hstspreload.org/). Web browsers will perform HTTPS upgrades to preloaded sites before receiving the initial `Strict-Transport-Security` header. This prevents [downgrade attacks](https://en.wikipedia.org/wiki/Downgrade_attack) upon first use and is recommended for all high-risk websites. Note that being included in the HSTS preload list also requires `includeSubDomains` to be set and `max-age` to be set to a minimum of 1 year (`31536000`).

Just adding preload to your HSTS header doesn't add you to the preload list, you still have to submit your site to the form.

gene1wood · 2024-06-18T22:44:52Z

files/en-us/web/security/practical_implementation_guides/index.md

+
+{{QuickLinksWithSubpages("/en-US/docs/Web/Security")}}
+
+Users frequently input sensitive data on websites, such as names, addresses, and banking details. As a web developer, it's crucial to protect this information from bad actors who use a wide range of exploits to steal such information and use it for personal gain. The focus of [web security](/en-US/docs/Web/Security) is to help you protect your website against these exploits and secure your users' sensitive data.


Suggested change

Users frequently input sensitive data on websites, such as names, addresses, and banking details. As a web developer, it's crucial to protect this information from bad actors who use a wide range of exploits to steal such information and use it for personal gain. The focus of [web security](/en-US/docs/Web/Security) is to help you protect your website against these exploits and secure your users' sensitive data.

Users frequently input sensitive data on websites, such as names, addresses, passwords and banking details. As a web developer, it's crucial to protect this information from bad actors who use a wide range of exploits to steal such information and use it for personal gain. The focus of [web security](/en-US/docs/Web/Security) is to help you protect your website against these exploits and secure your users' sensitive data.

Restructure security landing page

4703db1

chrisdavidmills requested a review from a team as a code owner May 28, 2024 13:14

chrisdavidmills requested review from Elchi3 and removed request for a team May 28, 2024 13:14

chrisdavidmills marked this pull request as draft May 28, 2024 13:15

github-actions bot added Content:Security Security docs size/m 51-500 LoC changed labels May 28, 2024

github-actions bot reviewed May 28, 2024

View reviewed changes

files/en-us/web/security/index.md Outdated Show resolved Hide resolved

Retitle and redirect Security your site page to Practical implementat…

c04092c

…ion guide

github-actions bot added size/l 501-1000 LoC changed and removed size/m 51-500 LoC changed labels May 28, 2024

Update files/en-us/web/security/index.md

5254100

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

github-actions bot reviewed May 28, 2024

View reviewed changes

files/en-us/web/security/index.md Outdated Show resolved Hide resolved

files/en-us/web/security/index.md Outdated Show resolved Hide resolved

chrisdavidmills and others added 3 commits May 28, 2024 14:50

Update files/en-us/web/security/index.md

c39da2b

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

initial draft of all Observatory pages

c7a383a

Merge branch 'add-observatory-docs-to-mdn' of github.com:chrisdavidmi…

3164d32

…lls/content into add-observatory-docs-to-mdn

github-actions bot added size/xl >1000 LoC changed and removed size/l 501-1000 LoC changed labels May 30, 2024

github-actions bot reviewed May 30, 2024

View reviewed changes

chrisdavidmills and others added 10 commits May 30, 2024 17:43

Update files/en-us/web/security/practical_implementation/clickjacking…

06d0b98

…/index.md Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

Update files/en-us/web/security/practical_implementation/clickjacking…

cc8a1bb

…/index.md Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

Update files/en-us/web/security/practical_implementation/cookies/inde…

d7d47c7

…x.md Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

Update files/en-us/web/security/practical_implementation/clickjacking…

64dd386

…/index.md Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

Update files/en-us/web/security/practical_implementation/cookies/inde…

0dc7334

…x.md Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

Update files/en-us/web/security/practical_implementation/referrer_pol…

883d4a5

…icy/index.md Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

Update files/en-us/web/security/practical_implementation/referrer_pol…

68659ec

…icy/index.md Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

Update files/en-us/web/security/practical_implementation/sri/index.md

8c03637

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

Update files/en-us/web/security/practical_implementation/sri/index.md

189313e

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

Update files/en-us/web/security/practical_implementation/tls/index.md

460025c

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

Tibap reviewed Jun 13, 2024

View reviewed changes

dipikabh reviewed Jun 13, 2024

View reviewed changes

files/en-us/web/security/practical_implementation_guides/cookies/index.md Outdated Show resolved Hide resolved

files/en-us/web/security/practical_implementation_guides/cookies/index.md Outdated Show resolved Hide resolved

dipikabh reviewed Jun 13, 2024

View reviewed changes

dipikabh requested changes Jun 13, 2024

View reviewed changes

github-actions bot added the merge conflicts 🚧 label Jun 13, 2024

Making fixes for review comments from dipika and tibap

74eae48

github-actions bot reviewed Jun 14, 2024

View reviewed changes

chrisdavidmills and others added 4 commits June 14, 2024 15:37

Update files/en-us/web/security/practical_implementation_guides/csrf_…

d7375f5

…prevention/index.md Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

Update files/en-us/web/security/practical_implementation_guides/index.md

006f2f7

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

Update files/en-us/web/security/practical_implementation_guides/index.md

e18b08f

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

Update files/en-us/web/security/practical_implementation_guides/tls/i…

26e178a

…ndex.md Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

dipikabh reviewed Jun 17, 2024

View reviewed changes

files/en-us/web/security/practical_implementation_guides/csp/index.md Outdated Show resolved Hide resolved

files/en-us/web/security/practical_implementation_guides/robots_txt/index.md Outdated Show resolved Hide resolved

dipikabh reviewed Jun 17, 2024

View reviewed changes

dipikabh approved these changes Jun 17, 2024

View reviewed changes

dipikabh reviewed Jun 17, 2024

View reviewed changes

files/en-us/web/html/attributes/autocomplete/index.md Outdated Show resolved Hide resolved

files/en-us/web/html/attributes/autocomplete/index.md Outdated Show resolved Hide resolved

files/en-us/web/html/element/form/index.md Outdated Show resolved Hide resolved

last few tweaks

796d616

chrisdavidmills closed this Jun 18, 2024

chrisdavidmills reopened this Jun 18, 2024

Merge branch 'main' into add-observatory-docs-to-mdn

75dd4d9

github-actions bot removed the merge conflicts 🚧 label Jun 18, 2024

dipikabh reviewed Jun 18, 2024

View reviewed changes

gene1wood reviewed Jun 18, 2024

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add Observatory docs to MDN #33793

Add Observatory docs to MDN #33793

chrisdavidmills commented May 28, 2024 •

edited

github-actions bot commented May 28, 2024 •

edited

Tibap Jun 13, 2024

chrisdavidmills Jun 14, 2024

Tibap Jun 13, 2024

chrisdavidmills Jun 14, 2024

Tibap Jun 18, 2024

Tibap Jun 13, 2024

chrisdavidmills Jun 14, 2024 •

edited

Tibap Jun 13, 2024

chrisdavidmills Jun 14, 2024

Tibap Jun 13, 2024

chrisdavidmills Jun 14, 2024

dipikabh Jun 13, 2024

chrisdavidmills Jun 14, 2024

dipikabh Jun 17, 2024

dipikabh Jun 13, 2024

dipikabh left a comment

github-actions bot commented Jun 13, 2024

chrisdavidmills commented Jun 14, 2024

dipikabh Jun 17, 2024

dipikabh left a comment

dipikabh left a comment

dipikabh Jun 18, 2024 •

edited

dipikabh Jun 18, 2024

gene1wood Jun 18, 2024

gene1wood Jun 18, 2024

gene1wood Jun 18, 2024

gene1wood Jun 18, 2024

gene1wood Jun 18, 2024

gene1wood Jun 18, 2024

gene1wood Jun 18, 2024

gene1wood Jun 18, 2024

gene1wood Jun 18, 2024

gene1wood Jun 18, 2024


		You are advised to use both strategies for websites that allow destructive changes such as account deletion. Anti-CRSF tokens are arguably unnecessary for other sites, although it is still advised to have `SameSite` set to a non-`None` value to help protect the user's [Privacy](/en-US/docs/Web/Privacy).

		Most application frameworks have built-in CSRF tokenization to ease implementation.


		[Clickjacking](/en-US/docs/Glossary/Clickjacking) is an attack whereby malicious sites trick users into clicking links or UI elements by making them appear like a trusted site the user is familiar with. This is usually done by embedding part or all of the trusted site into the malicious site via an `<iframe>`. A button, link, or other UI feature is then positioned on top of that content to make the user think they are interacting with their trusted site, when in fact they are interacting with the malicious site.

		## Solution

	\| [HSTS implementation](/en-US/docs/Web/Security/Practical_implementation_guides/TLS#http_strict_transport_security_implementation) \| High \| Low \| Yes \| Notify user agents to connect to sites only over HTTPS, even if the original scheme chosen was HTTP, using HTTP Strict transport security (HSTS). \|
	\| [HSTS implementation](/en-US/docs/Web/Security/Practical_implementation_guides/TLS#http_strict_transport_security_implementation) \| High \| Low \| Yes \| Use HTTP Strict transport security (HSTS) to notify browsers to connect to sites only over HTTPS, even if the original scheme chosen was HTTP. \|


		The guides are listed in the order that we recommend they are implemented. This order is based on a combination of security impact and ease of implementation from an operational and developmental perspective.

		\| Guide \| Impact \| Difficulty \| Required \| Summary \|

		Use `robots.txt` to reduce website load and stop unsuitable content appearing in search results.

		Using `robots.txt` is optional and sites should use it only for these purposes. It should not be used as a way to prevent the disclosure of private information or to hide portions of a website. While using this file can prevent these sites from appearing in search engine results, it does not secure websites against attackers who can still determine such details because `robots.txt` is publicly accessible.


		## See also

		- [About /robots.txt](https://www.robotstxt.org/robotstxt.html) on `robotstxt.org`.

	- : Cookies should be set to the most restrictive `Path` possible; for most applications, this will be set to the root directory.
	- : Cookies should be set to the most restrictive `Path` possible.


		## Problem

		Cookies often contain session identifiers or other sensitive information. Unwanted access to cookies, therefore, can cause a host of problems, including [privacy](/en-US/docs/Web/Privacy) issues, ({{Glossary("Cross-site_scripting", "Cross-site scripting (XSS)")}}) attacks, Cross-site request forgery ([CSRF](/en-US/docs/Glossary/CSRF)) attacks, and more.


		## Problem

		Attackers can modify the contents of JavaScript libraries hosted on content delivery networks (CDNs), creating vulnerabilities in all websites that use these libraries.

	Attackers can modify the contents of JavaScript libraries hosted on content delivery networks (CDNs), creating vulnerabilities in all websites that use these libraries.
	If an attacker exploited a content delivery network (CDN) and modified the contents of JavaScript libraries hosted on that CDN, it would create vulnerabilities in all websites that use those libraries.


		### Solution

		HTTP [`Strict-Transport-Security`](/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security) (HSTS) is an HTTP header that notifies browsers to connect to a given site only over HTTPS, even if the originally specified scheme was HTTP. Browsers with HSTS set for a given site will automatically upgrade all requests to HTTPS. HSTS also tells browsers to treat TLS and certificate-related errors more strictly by disabling the ability to bypass the error page.

	- : Specifies whether browsers should upgrade requests on all subdomains to HTTPS. For example, setting `includeSubDomains` on `domain.example.com` will ensure that requests to `host1.domain.example.com` and `host2.domain.example.com` are upgraded.
	- : Specifies whether browsers should upgrade requests on all subdomains to HTTPS. For example, setting `includeSubDomains` on `domain.example.com` will ensure that requests to `host1.domain.example.com` and `host2.domain.example.com` are also upgraded in addition to `domain.example.com`.

	- : Specifies whether the site should be preloaded. Including this directive means your site will be included in the [HSTS preload list](https://hstspreload.org/).
	- : Specifies whether the site should be preloaded. Including this directive means your site can be included in the [HSTS preload list](https://hstspreload.org/).


		{{QuickLinksWithSubpages("/en-US/docs/Web/Security")}}

		Users frequently input sensitive data on websites, such as names, addresses, and banking details. As a web developer, it's crucial to protect this information from bad actors who use a wide range of exploits to steal such information and use it for personal gain. The focus of [web security](/en-US/docs/Web/Security) is to help you protect your website against these exploits and secure your users' sensitive data.

Add Observatory docs to MDN #33793

Are you sure you want to change the base?

Add Observatory docs to MDN #33793

Conversation

chrisdavidmills commented May 28, 2024 • edited

Description

Motivation

Additional details

Related issues and pull requests

github-actions bot commented May 28, 2024 • edited

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

chrisdavidmills Jun 14, 2024 • edited

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

dipikabh left a comment

Choose a reason for hiding this comment

github-actions bot commented Jun 13, 2024

chrisdavidmills commented Jun 14, 2024

Choose a reason for hiding this comment

dipikabh left a comment

Choose a reason for hiding this comment

dipikabh left a comment

Choose a reason for hiding this comment

dipikabh Jun 18, 2024 • edited

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

chrisdavidmills commented May 28, 2024 •

edited

github-actions bot commented May 28, 2024 •

edited

chrisdavidmills Jun 14, 2024 •

edited

dipikabh Jun 18, 2024 •

edited