Add Observatory docs to MDN #33793

chrisdavidmills · 2024-05-28T13:14:50Z

Description

Mozilla Observatory is being moved to MDN. This PR adds the accompanying cheat sheet docs to MDN, and restructures the existing security docs to make space for them.

Motivation

Additional details

See mdn/mdn#548 for the MDN project tracking item.

Related issues and pull requests

Updating the HTTP sidebar links to point to the updated Observatory and docs locations: [DON'T MERGE YET] Update Observatory links in HTTPsidebar yari#11236

files/en-us/web/security/index.md

github-actions · 2024-05-28T13:16:31Z

Preview URLs (20 pages)

Flaws (5)

Note! 15 documents with no flaws that don't need to be listed. 🎉

URL: /en-US/docs/Web/HTTP/Headers/X-Content-Type-Options
Title: X-Content-Type-Options
Flaw count: 1

broken_links:
- Can't resolve /en-US/observatory/

URL: /en-US/docs/Web/Security
Title: Security on the web
Flaw count: 1

broken_links:
- Can't resolve /en-US/observatory/

URL: /en-US/docs/Web/Security/Practical_implementation_guides
Title: Practical security implementation guides
Flaw count: 1

broken_links:
- Can't resolve /en-US/observatory/

URL: /en-US/docs/Web/Security/Transport_Layer_Security
Title: Transport Layer Security
Flaw count: 1

broken_links:
- Can't resolve /en-US/observatory/

URL: /en-US/docs/Learn/Server-side/Apache_Configuration_htaccess
Title: Apache Configuration: .htaccess
Flaw count: 1

broken_links:
- Can't resolve /en-US/observatory/

External URLs (27)

URL: /en-US/docs/Web/Security
Title: Security on the web

https://blog.mozilla.org/security/ (1 time) (Note! This may be a new URL 👀)
https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html (1 time) (Note! This may be a new URL 👀)
https://cheatsheetseries.owasp.org/index.html (1 time) (Note! This may be a new URL 👀)
https://en.wikipedia.org/wiki/Man-in-the-middle_attack (1 time) (Note! This may be a new URL 👀)
https://owasp.org/www-community/vulnerabilities/Information_exposure_through_query_strings_in_url (1 time) (Note! This may be a new URL 👀)
https://web.archive.org/ (1 time) (Note! This may be a new URL 👀)

URL: /en-US/docs/Web/Security/Practical_implementation_guides
Title: Practical security implementation guides

https://cheatsheetseries.owasp.org/ (1 time) (Note! This may be a new URL 👀)
https://owasp.org/www-community/attacks/ (1 time) (Note! This may be a new URL 👀)

URL: /en-US/docs/Web/Security/Practical_implementation_guides/CORP
Title: Cross-Origin Resource Policy (CORP) implementation

https://en.wikipedia.org/wiki/Meltdown_(security_vulnerability) (1 time) (Note! This may be a new URL 👀)
https://en.wikipedia.org/wiki/Spectre_(security_vulnerability) (1 time) (Note! This may be a new URL 👀)

URL: /en-US/docs/Web/Security/Practical_implementation_guides/Turning_off_form_autocompletion
Title: How to turn off form autocompletion

https://www.w3.org/WAI/WCAG21/Understanding/identify-input-purpose.html (1 time) (Note! This may be a new URL 👀)

URL: /en-US/docs/Web/Security/Practical_implementation_guides/CSP
Title: Content Security Policy (CSP) implementation

https://csp-evaluator.withgoogle.com/ (1 time) (Note! This may be a new URL 👀)

URL: /en-US/docs/Web/Security/Practical_implementation_guides/SRI
Title: Subresource integrity (SRI) implementation

https://www.srihash.org/ (1 time) (Note! This may be a new URL 👀)

URL: /en-US/docs/Web/Security/Practical_implementation_guides/Clickjacking
Title: Clickjacking prevention

https://auth0.com/blog/preventing-clickjacking-attacks/ (1 time) (Note! This may be a new URL 👀)
https://cheatsheetseries.owasp.org/cheatsheets/Clickjacking_Defense_Cheat_Sheet.html (2 times) (Note! This may be a new URL 👀)

URL: /en-US/docs/Web/Security/Practical_implementation_guides/CORS
Title: Cross-Origin Resource Sharing (CORS) configuration

https://w3c.github.io/webappsec-cors-for-developers/ (1 time) (Note! This may be a new URL 👀)

URL: /en-US/docs/Web/Security/Practical_implementation_guides/Cookies
Title: Secure cookie configuration

https://datatracker.ietf.org/doc/html/rfc6265 (1 time) (Note! This may be a new URL 👀)

URL: /en-US/docs/Web/Security/Practical_implementation_guides/Robots_txt
Title: robots.txt configuration

https://www.robotstxt.org/robotstxt.html (1 time) (Note! This may be a new URL 👀)

URL: /en-US/docs/Web/Security/Practical_implementation_guides/TLS
Title: Transport Layer Security (TLS) configuration

https://en.wikipedia.org/wiki/Downgrade_attack (1 time) (Note! This may be a new URL 👀)
https://example.com/ (3 times) (Note! This may be a new URL 👀)
https://example.org/ (1 time) (Note! This may be a new URL 👀)
https://hstspreload.org/ (2 times) (Note! This may be a new URL 👀)
https://ssl-config.mozilla.org/ (1 time) (Note! This may be a new URL 👀)
https://wiki.mozilla.org/Security/Server_Side_TLS (1 time) (Note! This may be a new URL 👀)

URL: /en-US/docs/Web/Security/Practical_implementation_guides/CSRF_prevention
Title: Cross-site request forgery (CSRF) prevention

https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html (1 time) (Note! This may be a new URL 👀)
https://en.wikipedia.org/wiki/Cross-site_request_forgery (1 time) (Note! This may be a new URL 👀)

URL: /en-US/docs/Web/Security/Transport_Layer_Security
Title: Transport Layer Security

https://www.ssllabs.com/ssltest/ (1 time) (Note! This may be a new URL 👀)

(comment last updated: 2024-06-19 16:29:01)

…ion guide

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

files/en-us/web/security/index.md

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

…lls/content into add-observatory-docs-to-mdn

files/en-us/web/security/practical_implementation/clickjacking/index.md

files/en-us/web/security/practical_implementation/cookies/index.md

files/en-us/web/security/practical_implementation/referrer_policy/index.md

files/en-us/web/security/practical_implementation/sri/index.md

files/en-us/web/security/practical_implementation/tls/index.md

…/index.md Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

…x.md Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

…/index.md Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

…x.md Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

…icy/index.md Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

github-actions · 2024-06-13T23:06:58Z

This pull request has merge conflicts that must be resolved before it can be merged.

chrisdavidmills · 2024-06-14T13:40:40Z

My preference is to use only the acronym in the sidebar (short-title) and the expanded title on the page, so:

@dipikabh the problem with this is that short titles don't work with this type of sidebar (I think they only work in API sidebars). I tried this out the first time around when I noticed the titles were a bit long in the sidebar.

files/en-us/web/security/practical_implementation_guides/csrf_prevention/index.md

files/en-us/web/security/practical_implementation_guides/index.md

files/en-us/web/security/practical_implementation_guides/tls/index.md

…prevention/index.md Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

…ndex.md Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

files/en-us/web/security/practical_implementation_guides/csp/index.md

files/en-us/web/security/practical_implementation_guides/robots_txt/index.md

files/en-us/web/security/practical_implementation_guides/tls/index.md

dipikabh · 2024-06-17T20:37:53Z

files/en-us/web/security/practical_implementation_guides/index.md

+| [TLS configuration](/en-US/docs/Web/Security/Practical_implementation_guides/TLS#tls_configuration) | Medium | Medium | Yes | Use the most secure [Transport Layer Security](/en-US/docs/Glossary/TLS) (TLS) configuration available for your user base. |
+| [Resource loading](/en-US/docs/Web/Security/Practical_implementation_guides/TLS#resource_loading) | Maximum | Low | Yes | Load both passive and active resources via HTTPS. |
+| [HTTP redirection](/en-US/docs/Web/Security/Practical_implementation_guides/TLS#http_redirections) | Maximum | Low | Yes | Websites must redirect to HTTPS; API endpoints should disable HTTP entirely. |
+| [HSTS implementation](/en-US/docs/Web/Security/Practical_implementation_guides/TLS#http_strict_transport_security_implementation) | High | Low | Yes | Notify user agents to connect to sites only over HTTPS, even if the original scheme chosen was HTTP, using HTTP Strict transport security (HSTS). |


Ah, didn't notice the close proximity of "to"s but doesn't seem too bad to me readability-wise

dipikabh

Preview pages for the last few files did not update, I am guessing because of an incomplete check (check-redirects).
I'm going by your updates/responses and the overall content is looking in good shape. Leaving my +1 here. Let me know if you need me to check anything again. Thanks @chrisdavidmills!

dipikabh

Some links might need to be updated

files/en-us/web/html/attributes/autocomplete/index.md

files/en-us/web/html/element/form/index.md

dipikabh · 2024-06-18T16:57:28Z

files/en-us/web/security/practical_implementation_guides/robots_txt/index.md

+Use `robots.txt` to reduce website load and stop unsuitable content appearing in search results.
+
+Using `robots.txt` is optional and sites should use it only for these purposes. It should not be used as a way to prevent the disclosure of private information or to hide portions of a website. While using this file can prevent these sites from appearing in search engine results, it does not secure websites against attackers who can still determine such details because `robots.txt` is publicly accessible.


Nit: WDYT about moving around the sentences a bit. The part that it doesn't secure websites should stand out on it's own, possibly can even be highlighted as a note.

Suggested change

Use `robots.txt` to reduce website load and stop unsuitable content appearing in search results.

Using `robots.txt` is optional and sites should use it only for these purposes. It should not be used as a way to prevent the disclosure of private information or to hide portions of a website. While using this file can prevent these sites from appearing in search engine results, it does not secure websites against attackers who can still determine such details because `robots.txt` is publicly accessible.

Use `robots.txt` to reduce website load and stop unsuitable content appearing in search results. Using this file is optional and sites should use it only for these purposes. Don't use `robots.txt` as a way to prevent the disclosure of private information or to hide portions of a website.

While using this file can prevent these sites from appearing in search engine results, it does not secure websites against attackers who can still determine such details because `robots.txt` is publicly accessible.

files/en-us/web/security/practical_implementation_guides/robots_txt/index.md

gene1wood · 2024-06-18T17:54:41Z

files/en-us/web/security/practical_implementation_guides/cookies/index.md

+- `Domain`
+ - : Cookies should only have a `Domain` set if they need to be accessible on other domains; this should be set to the most restrictive domain possible.
+- `Path`
+ - : Cookies should be set to the most restrictive `Path` possible; for most applications, this will be set to the root directory.


Suggested change

- : Cookies should be set to the most restrictive `Path` possible; for most applications, this will be set to the root directory.

- : Cookies should be set to the most restrictive `Path` possible.

This line is a bit confusing as it starts by saying to set Path to the most restrictive value, but then follows by saying that most of the time it's set to the root directory which is the least restrictive value.

Agreed that this is confusingly-phased. I have made this change in my next commit.

gene1wood · 2024-06-18T17:56:11Z

files/en-us/web/security/practical_implementation_guides/cookies/index.md

+
+## Problem
+
+Cookies often contain session identifiers or other sensitive information. Unwanted access to cookies, therefore, can cause a host of problems, including [privacy](/en-US/docs/Web/Privacy) issues, ({{Glossary("Cross-site_scripting", "Cross-site scripting (XSS)")}}) attacks, Cross-site request forgery ([CSRF](/en-US/docs/Glossary/CSRF)) attacks, and more.


This phrase

Unwanted access to cookies, therefore, can cause a host of problem

is confusing to me. Maybe change Unwanted to Unauthorized?

This is much clearer; updated. Thanks!

gene1wood · 2024-06-18T17:56:52Z

files/en-us/web/security/practical_implementation_guides/cookies/index.md

+- `Path`
+ - : Cookies should be set to the most restrictive `Path` possible; for most applications, this will be set to the root directory.
+- `SameSite`
+ - : Forbid sending the cookie via cross-origin requests (for example from {{htmlelement("img")}} element), as a strong [anti-CSRF](/en-US/docs/Web/Security/Practical_implementation_guides/CSRF_prevention) measure. `SameSite` is also useful in protecting against [Clickjacking](/en-US/docs/Glossary/Clickjacking) attacks, in cases that rely on the user being authenticated. You should use one of the following two values:


Suggested change

- : Forbid sending the cookie via cross-origin requests (for example from {{htmlelement("img")}} element), as a strong [anti-CSRF](/en-US/docs/Web/Security/Practical_implementation_guides/CSRF_prevention) measure. `SameSite` is also useful in protecting against [Clickjacking](/en-US/docs/Glossary/Clickjacking) attacks, in cases that rely on the user being authenticated. You should use one of the following two values:

- : Forbid sending the cookie via cross-origin requests (for example from an {{htmlelement("img")}} element), as a strong [anti-CSRF](/en-US/docs/Web/Security/Practical_implementation_guides/CSRF_prevention) measure by setting `SameSite` to `Strict`. `SameSite` is also useful in protecting against [Clickjacking](/en-US/docs/Glossary/Clickjacking) attacks, in cases that rely on the user being authenticated. You should use one of the following two values:

I've made a couple of updates here, but I've not added "by setting SameSite to Strict" — the end of the paragraph and the following sub-bullets detail which values to use.

Are you saying you think it should always be set to Strict? I thought Lax was OK if Strict caused problems?

gene1wood · 2024-06-18T18:11:38Z

files/en-us/web/security/practical_implementation_guides/robots_txt/index.md

+Disallow: /
+```
+
+Hide certain directories (this is not recommended):


Can we add details as to why it's bad to hide certain directories from a crawler but not the entire site? I don't know the "why" behind this.

I've looked into this a bit more, and improved the content of the "Solution" section to make this clearer:

Using robots.txt is optional and sites should use it only for these purposes. It should not be used as a way to prevent the disclosure of private information or to hide portions of a website. While using this file can prevent pages from appearing in search engine results, it does not secure websites against attackers. In fact, it can help them: robots.txt is publicly accessible, and by adding your sensitive page paths to it, you are showing attackers exactly where they are.

Also be aware that some robots will ignore your robots.txt file, for example, malware robots and email address harvesters.

gene1wood · 2024-06-18T18:13:12Z

files/en-us/web/security/practical_implementation_guides/sri/index.md

+
+## Problem
+
+Attackers can modify the contents of JavaScript libraries hosted on content delivery networks (CDNs), creating vulnerabilities in all websites that use these libraries.


Suggested change

Attackers can modify the contents of JavaScript libraries hosted on content delivery networks (CDNs), creating vulnerabilities in all websites that use these libraries.

If an attacker exploited a content delivery network (CDN) and modified the contents of JavaScript libraries hosted on that CDN, it would create vulnerabilities in all websites that use those libraries.

gene1wood · 2024-06-18T22:36:05Z

files/en-us/web/security/practical_implementation_guides/tls/index.md

+
+### Solution
+
+HTTP [`Strict-Transport-Security`](/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security) (HSTS) is an HTTP header that notifies browsers to connect to a given site only over HTTPS, even if the originally specified scheme was HTTP. Browsers with HSTS set for a given site will automatically upgrade all requests to HTTPS. HSTS also tells browsers to treat TLS and certificate-related errors more strictly by disabling the ability to bypass the error page.


Suggested change

HTTP [`Strict-Transport-Security`](/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security) (HSTS) is an HTTP header that notifies browsers to connect to a given site only over HTTPS, even if the originally specified scheme was HTTP. Browsers with HSTS set for a given site will automatically upgrade all requests to HTTPS. HSTS also tells browsers to treat TLS and certificate-related errors more strictly by disabling the ability to bypass the error page.

HTTP [`Strict-Transport-Security`](/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security) (HSTS) is an HTTP header that notifies browsers to connect to a given site only over HTTPS, even if the originally specified scheme was HTTP. Browsers with HSTS set for a given site will automatically upgrade all requests to HTTPS for that site. HSTS also tells browsers to treat TLS and certificate-related errors more strictly by disabling the ability to bypass the certificate error page.

gene1wood · 2024-06-18T22:36:51Z

files/en-us/web/security/practical_implementation_guides/tls/index.md

+- `max-age`
+ - : Sets the duration, in seconds, for which browsers will redirect to HTTPS.
+- `includeSubDomains` {{optional_inline}}
+ - : Specifies whether browsers should upgrade requests on all subdomains to HTTPS. For example, setting `includeSubDomains` on `domain.example.com` will ensure that requests to `host1.domain.example.com` and `host2.domain.example.com` are upgraded.


Suggested change

- : Specifies whether browsers should upgrade requests on all subdomains to HTTPS. For example, setting `includeSubDomains` on `domain.example.com` will ensure that requests to `host1.domain.example.com` and `host2.domain.example.com` are upgraded.

- : Specifies whether browsers should upgrade requests on all subdomains to HTTPS. For example, setting `includeSubDomains` on `domain.example.com` will ensure that requests to `host1.domain.example.com` and `host2.domain.example.com` are also upgraded in addition to `domain.example.com`.

gene1wood · 2024-06-18T22:40:04Z

files/en-us/web/security/practical_implementation_guides/tls/index.md

+- `includeSubDomains` {{optional_inline}}
+ - : Specifies whether browsers should upgrade requests on all subdomains to HTTPS. For example, setting `includeSubDomains` on `domain.example.com` will ensure that requests to `host1.domain.example.com` and `host2.domain.example.com` are upgraded.
+- `preload` {{optional_inline}}
+ - : Specifies whether the site should be preloaded. Including this directive means your site will be included in the [HSTS preload list](https://hstspreload.org/).


Suggested change

- : Specifies whether the site should be preloaded. Including this directive means your site will be included in the [HSTS preload list](https://hstspreload.org/).

- : Specifies whether the site should be preloaded. Including this directive means your site can be included in the [HSTS preload list](https://hstspreload.org/).

gene1wood · 2024-06-18T22:42:54Z

files/en-us/web/security/practical_implementation_guides/tls/index.md

+
+1. Set a `max-age` value of at least six months (`15768000`). Longer periods, such as two years (`63072000`), are recommended. Once this value is set, the site must continue to support HTTPS until the expiry time is reached.
+2. If possible, set `includeSubDomains` to improve security on all subdomains. Careful testing is needed when setting this directive because it could disable sites on subdomains that don't yet have HTTPS enabled.
+3. If possible, set `preload` to include your website in the [HSTS preload list](https://hstspreload.org/). Web browsers will perform HTTPS upgrades to preloaded sites before receiving the initial `Strict-Transport-Security` header. This prevents [downgrade attacks](https://en.wikipedia.org/wiki/Downgrade_attack) upon first use and is recommended for all high-risk websites. Note that being included in the HSTS preload list also requires `includeSubDomains` to be set and `max-age` to be set to a minimum of 1 year (`31536000`).


Suggested change

3. If possible, set `preload` to include your website in the [HSTS preload list](https://hstspreload.org/). Web browsers will perform HTTPS upgrades to preloaded sites before receiving the initial `Strict-Transport-Security` header. This prevents [downgrade attacks](https://en.wikipedia.org/wiki/Downgrade_attack) upon first use and is recommended for all high-risk websites. Note that being included in the HSTS preload list also requires `includeSubDomains` to be set and `max-age` to be set to a minimum of 1 year (`31536000`).

3. If possible, set `preload` to make it possible to include your website in the [HSTS preload list](https://hstspreload.org/). Web browsers will perform HTTPS upgrades to preloaded sites before receiving the initial `Strict-Transport-Security` header. This prevents [downgrade attacks](https://en.wikipedia.org/wiki/Downgrade_attack) upon first use and is recommended for all high-risk websites. Note that being included in the HSTS preload list also requires `includeSubDomains` to be set and `max-age` to be set to a minimum of 1 year (`31536000`).

Just adding preload to your HSTS header doesn't add you to the preload list, you still have to submit your site to the form.

Thanks for clarifying that; I wanted to make that clear, but the site wasn't exactly clear about what was required. I have implemented your change and updated the bullet further, to:

If possible, set preload to make it possible to include your website in the HSTS preload list. To add it to the list, visit https://hstspreload.org/ and enter your site URL into the form at the top of the page, fixing any issues that it mentions. Web browsers will perform HTTPS upgrades to preloaded sites before receiving the initial Strict-Transport-Security header. This prevents downgrade attacks upon first use and is recommended for all high-risk websites. Note that being included in the HSTS preload list also requires includeSubDomains to be set and max-age to be set to a minimum of 1 year (31536000).

Does this sound OK?

gene1wood · 2024-06-18T22:44:52Z

files/en-us/web/security/practical_implementation_guides/index.md

+
+{{QuickLinksWithSubpages("/en-US/docs/Web/Security")}}
+
+Users frequently input sensitive data on websites, such as names, addresses, and banking details. As a web developer, it's crucial to protect this information from bad actors who use a wide range of exploits to steal such information and use it for personal gain. The focus of [web security](/en-US/docs/Web/Security) is to help you protect your website against these exploits and secure your users' sensitive data.


Suggested change

Users frequently input sensitive data on websites, such as names, addresses, and banking details. As a web developer, it's crucial to protect this information from bad actors who use a wide range of exploits to steal such information and use it for personal gain. The focus of [web security](/en-US/docs/Web/Security) is to help you protect your website against these exploits and secure your users' sensitive data.

Users frequently input sensitive data on websites, such as names, addresses, passwords and banking details. As a web developer, it's crucial to protect this information from bad actors who use a wide range of exploits to steal such information and use it for personal gain. The focus of [web security](/en-US/docs/Web/Security) is to help you protect your website against these exploits and secure your users' sensitive data.

chrisdavidmills · 2024-06-19T12:56:05Z

@gene1wood thanks for the review! I've fixed most things, but just had a few comments asking for clarification on a few points.

dipikabh · 2024-06-19T16:18:22Z

files/en-us/web/security/practical_implementation_guides/index.md

+| [TLS configuration](/en-US/docs/Web/Security/Practical_implementation_guides/TLS#tls_configuration) | Medium | Medium | Yes | Use the most secure [Transport Layer Security](/en-US/docs/Glossary/TLS) (TLS) configuration available for your user base. |
+| TLS: [Resource loading](/en-US/docs/Web/Security/Practical_implementation_guides/TLS#resource_loading) | Maximum | Low | Yes | Load both passive and active resources via HTTPS. |
+| TLS: [HTTP redirection](/en-US/docs/Web/Security/Practical_implementation_guides/TLS#http_redirection) | Maximum | Low | Yes | Websites must redirect to HTTPS; API endpoints should disable HTTP entirely. |
+| TLS: [HSTS implementation](/en-US/docs/Web/Security/Practical_implementation_guides/TLS#http_strict_transport_security_implementation) | High | Low | Yes | Notify user agents to connect to sites only over HTTPS, even if the original scheme chosen was HTTP, using HTTP Strict transport security (HSTS). |


Suggested change

| TLS: [HSTS implementation](/en-US/docs/Web/Security/Practical_implementation_guides/TLS#http_strict_transport_security_implementation) | High | Low | Yes | Notify user agents to connect to sites only over HTTPS, even if the original scheme chosen was HTTP, using HTTP Strict transport security (HSTS). |

| TLS: [HSTS implementation](/en-US/docs/Web/Security/Practical_implementation_guides/TLS#http_strict_transport_security_implementation) | High | Low | Yes | Notify user agents to connect to sites only over HTTPS, even if the original scheme chosen was HTTP, by using HTTP Strict transport security (HSTS). |

dipikabh · 2024-06-19T16:18:38Z

files/en-us/web/security/practical_implementation_guides/index.md

+| [Clickjacking prevention](/en-US/docs/Web/Security/Practical_implementation_guides/Clickjacking) | High | Low | Yes | Control how your site may be framed within an {{htmlelement("iframe")}} to prevent [clickjacking](/en-US/docs/Glossary/Clickjacking). |
+| [CSRF prevention](/en-US/docs/Web/Security/Practical_implementation_guides/CSRF_prevention) | High | Unknown | Varies | Protect against [Cross-site request forgery](/en-US/docs/Glossary/CSRF) (CSRF) using `SameSite` cookies and anti-CSRF tokens. |
+| [Secure cookie configuration](/en-US/docs/Web/Security/Practical_implementation_guides/Cookies) | High | Medium | Yes | Set all cookies as restrictively as possible. |
+| [CORP implementation](/en-US/docs/Web/Security/Practical_implementation_guides/CORP) | High | Medium | Yes | Protect against speculative side-channel attacks using Cross-Origin Resource Policy (CORP). |


dipikabh · 2024-06-19T16:20:02Z

files/en-us/web/security/practical_implementation_guides/index.md

+| [CORP implementation](/en-US/docs/Web/Security/Practical_implementation_guides/CORP) | High | Medium | Yes | Protect against speculative side-channel attacks using Cross-Origin Resource Policy (CORP). |
+| [MIME type verification](/en-US/docs/Web/Security/Practical_implementation_guides/MIME_types) | Low | Low | No | Verify that all your websites are setting the proper [MIME types](/en-US/docs/Glossary/MIME_type) for all resources. |
+| [CSP implementation](/en-US/docs/Web/Security/Practical_implementation_guides/CSP) | High | High | Yes | Provide fine-grained control over where site resources can be loaded from with [Content Security Policy](/en-US/docs/Glossary/CSP) (CSP). |
+| [CORS configuration](/en-US/docs/Web/Security/Practical_implementation_guides/CORS) | High | Low | Yes | Define which non-same origins are allowed to access the content of pages and have resources loaded from them with [Cross-Origin Resource Sharing](/en-US/docs/Glossary/CORS) (CORS). |


Suggested change

| [CORS configuration](/en-US/docs/Web/Security/Practical_implementation_guides/CORS) | High | Low | Yes | Define which non-same origins are allowed to access the content of pages and have resources loaded from them with [Cross-Origin Resource Sharing](/en-US/docs/Glossary/CORS) (CORS). |

| [CORS configuration](/en-US/docs/Web/Security/Practical_implementation_guides/CORS) | High | Low | Yes | Define the non-same origins that are allowed to access the content of pages and have resources loaded from them by using [Cross-Origin Resource Sharing](/en-US/docs/Glossary/CORS) (CORS). |

dipikabh · 2024-06-19T16:20:45Z

files/en-us/web/security/practical_implementation_guides/index.md

+| [CORS configuration](/en-US/docs/Web/Security/Practical_implementation_guides/CORS) | High | Low | Yes | Define which non-same origins are allowed to access the content of pages and have resources loaded from them with [Cross-Origin Resource Sharing](/en-US/docs/Glossary/CORS) (CORS). |
+| [Referrer policy configuration](/en-US/docs/Web/Security/Practical_implementation_guides/Referrer_policy) | Low | Low | Yes | Improve privacy for users and prevent leaking of internal URLs via the {{httpheader("Referer")}} header. |
+| [robots.txt configuration](/en-US/docs/Web/Security/Practical_implementation_guides/Robots_txt) | Low | Low | No | Tell robots (such as search engine indexers) how to behave by instructing them not to crawl certain paths on the website. |
+| [SRI implementation](/en-US/docs/Web/Security/Practical_implementation_guides/SRI) | Low | Low | No | Verify that fetched resources (for example, from a CDN) are delivered without unexpected manipulation using [Subresource Integrity](/en-US/docs/Glossary/SRI) (SRI). |


Suggested change

| [SRI implementation](/en-US/docs/Web/Security/Practical_implementation_guides/SRI) | Low | Low | No | Verify that fetched resources (for example, from a CDN) are delivered without unexpected manipulation using [Subresource Integrity](/en-US/docs/Glossary/SRI) (SRI). |

| [SRI implementation](/en-US/docs/Web/Security/Practical_implementation_guides/SRI) | Low | Low | No | Verify that fetched resources (for example, from a CDN) are delivered without unexpected manipulation by using [Subresource Integrity](/en-US/docs/Glossary/SRI) (SRI). |

dipikabh · 2024-06-19T16:34:45Z

files/en-us/web/security/practical_implementation_guides/index.md

+
+This page lists guides that detail the best practices for implementing security features on websites. While these guides do not cover all possible security scenarios and cannot guarantee complete security of your website, following the information and best practices in these guides will make your sites significantly more secure.
+
+## Content security fundamentals


Sorry, coming back to these headings. Currently, the H2s seem a bit non-parallel:

# Practical security implementation guides ## Content security fundamentals ## User information security

WDYT about these H2s:

# Practical security implementation guides ## Fundamentals of securing website content ## Securing user information

or

# Practical security implementation guides ## Securing website content ## Securing user information

dipikabh · 2024-06-19T17:08:54Z

files/en-us/web/security/practical_implementation_guides/corp/index.md

+
+## Solution
+
+Use `Cross-Origin-Resource-Policy` to block [`no-cors`](/en-US/docs/Web/API/fetch#mode) cross-origin and/or cross-site requests to the given resource. Use the most restrictive value possible for your site: `same-site` or `same-origin` are recommended.


Suggested change

Use `Cross-Origin-Resource-Policy` to block [`no-cors`](/en-US/docs/Web/API/fetch#mode) cross-origin and/or cross-site requests to the given resource. Use the most restrictive value possible for your site: `same-site` or `same-origin` are recommended.

Use `Cross-Origin-Resource-Policy` to block [`no-cors`](/en-US/docs/Web/API/fetch#mode) cross-origin and/or cross-site requests to the given resource. Use the most restrictive value possible for your site; `same-origin` or `same-site` is recommended.

dipikabh · 2024-06-19T17:09:21Z

files/en-us/web/security/practical_implementation_guides/corp/index.md

+
+Use `Cross-Origin-Resource-Policy` to block [`no-cors`](/en-US/docs/Web/API/fetch#mode) cross-origin and/or cross-site requests to the given resource. Use the most restrictive value possible for your site: `same-site` or `same-origin` are recommended.
+
+As this policy is expressed via a response header, the actual request is not prevented — rather, the browser prevents the result from being leaked by stripping the response body.


Suggested change

As this policy is expressed via a response header, the actual request is not prevented — rather, the browser prevents the result from being leaked by stripping the response body.

As this policy is expressed via a response header, the actual request is not prevented. Instead, the browser prevents the result from being leaked by stripping the response body.

dipikabh · 2024-06-19T17:16:13Z

files/en-us/web/security/practical_implementation_guides/corp/index.md

+
+## Examples
+
+Instruct browsers to disallow cross-origin no-cors requests:


or this?

Suggested change

Instruct browsers to disallow cross-origin no-cors requests:

Instruct browsers to disallow cross-origin requests with `no-cors` mode:

dipikabh · 2024-06-19T17:17:32Z

files/en-us/web/security/practical_implementation_guides/corp/index.md

+## See also
+
+- [`Access-Control-Allow-Origin`](/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Origin)
+- [Cross-Origin Resource Sharing (CORS)](/en-US/docs/Web/HTTP/CORS)


CORS can be moved to the end of the list

dipikabh · 2024-06-19T17:19:33Z

files/en-us/web/security/practical_implementation_guides/robots_txt/index.md

+
+Using `robots.txt` is optional and sites should use it only for these purposes. It should not be used as a way to prevent the disclosure of private information or to hide portions of a website. While using this file can prevent pages from appearing in search engine results, it does not secure websites against attackers. In fact, it can help them: `robots.txt` is publicly accessible, and by adding your sensitive page paths to it, you are showing attackers exactly where they are.
+
+Also be aware that some robots will ignore your `robots.txt` file, for example, malware robots and email address harvesters.


Suggested change

Also be aware that some robots will ignore your `robots.txt` file, for example, malware robots and email address harvesters.

Also be aware that some robots, such as malware robots and email address harvesters, will ignore your `robots.txt` file.

dipikabh · 2024-06-19T17:27:36Z

files/en-us/web/security/practical_implementation_guides/robots_txt/index.md

+
+Use `robots.txt` to reduce website load and stop unsuitable content appearing in search results.
+
+Using `robots.txt` is optional and sites should use it only for these purposes. It should not be used as a way to prevent the disclosure of private information or to hide portions of a website. While using this file can prevent pages from appearing in search engine results, it does not secure websites against attackers. In fact, it can help them: `robots.txt` is publicly accessible, and by adding your sensitive page paths to it, you are showing attackers exactly where they are.


Suggested change

Using `robots.txt` is optional and sites should use it only for these purposes. It should not be used as a way to prevent the disclosure of private information or to hide portions of a website. While using this file can prevent pages from appearing in search engine results, it does not secure websites against attackers. In fact, it can help them: `robots.txt` is publicly accessible, and by adding your sensitive page paths to it, you are showing attackers exactly where they are.

Using `robots.txt` is optional and should only be used for these purposes. It should not be used as a way to prevent the disclosure of private information or to hide portions of a website. While using this file can prevent pages from appearing in search engine results, it does not secure websites against attackers. On the contrary, it can unintentionally help them: `robots.txt` is publicly accessible, and by adding your sensitive page paths to it, you are showing their locations to potential attackers.

Restructure security landing page

4703db1

chrisdavidmills requested a review from a team as a code owner May 28, 2024 13:14

chrisdavidmills requested review from Elchi3 and removed request for a team May 28, 2024 13:14

chrisdavidmills marked this pull request as draft May 28, 2024 13:15

github-actions bot added Content:Security Security docs size/m 51-500 LoC changed labels May 28, 2024

github-actions bot reviewed May 28, 2024

View reviewed changes

files/en-us/web/security/index.md Outdated Show resolved Hide resolved

Retitle and redirect Security your site page to Practical implementat…

c04092c

…ion guide

github-actions bot added size/l 501-1000 LoC changed and removed size/m 51-500 LoC changed labels May 28, 2024

Update files/en-us/web/security/index.md

5254100

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

github-actions bot reviewed May 28, 2024

View reviewed changes

files/en-us/web/security/index.md Outdated Show resolved Hide resolved

files/en-us/web/security/index.md Outdated Show resolved Hide resolved

chrisdavidmills and others added 3 commits May 28, 2024 14:50

Update files/en-us/web/security/index.md

c39da2b

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

initial draft of all Observatory pages

c7a383a

Merge branch 'add-observatory-docs-to-mdn' of github.com:chrisdavidmi…

3164d32

…lls/content into add-observatory-docs-to-mdn

github-actions bot added size/xl >1000 LoC changed and removed size/l 501-1000 LoC changed labels May 30, 2024

github-actions bot reviewed May 30, 2024

View reviewed changes

chrisdavidmills and others added 10 commits May 30, 2024 17:43

Update files/en-us/web/security/practical_implementation/clickjacking…

06d0b98

…/index.md Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

Update files/en-us/web/security/practical_implementation/clickjacking…

cc8a1bb

…/index.md Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

Update files/en-us/web/security/practical_implementation/cookies/inde…

d7d47c7

…x.md Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

Update files/en-us/web/security/practical_implementation/clickjacking…

64dd386

…/index.md Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

Update files/en-us/web/security/practical_implementation/cookies/inde…

0dc7334

…x.md Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

Update files/en-us/web/security/practical_implementation/referrer_pol…

883d4a5

…icy/index.md Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

Update files/en-us/web/security/practical_implementation/referrer_pol…

68659ec

…icy/index.md Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

Update files/en-us/web/security/practical_implementation/sri/index.md

8c03637

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

Update files/en-us/web/security/practical_implementation/sri/index.md

189313e

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

Update files/en-us/web/security/practical_implementation/tls/index.md

460025c

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

github-actions bot added the merge conflicts 🚧 label Jun 13, 2024

Making fixes for review comments from dipika and tibap

74eae48

github-actions bot reviewed Jun 14, 2024

View reviewed changes

chrisdavidmills and others added 4 commits June 14, 2024 15:37

Update files/en-us/web/security/practical_implementation_guides/csrf_…

d7375f5

…prevention/index.md Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

Update files/en-us/web/security/practical_implementation_guides/index.md

006f2f7

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

Update files/en-us/web/security/practical_implementation_guides/index.md

e18b08f

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

Update files/en-us/web/security/practical_implementation_guides/tls/i…

26e178a

…ndex.md Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

dipikabh reviewed Jun 17, 2024

View reviewed changes

files/en-us/web/security/practical_implementation_guides/csp/index.md Outdated Show resolved Hide resolved

files/en-us/web/security/practical_implementation_guides/robots_txt/index.md Outdated Show resolved Hide resolved

dipikabh reviewed Jun 17, 2024

View reviewed changes

dipikabh approved these changes Jun 17, 2024

View reviewed changes

dipikabh reviewed Jun 17, 2024

View reviewed changes

files/en-us/web/html/attributes/autocomplete/index.md Outdated Show resolved Hide resolved

files/en-us/web/html/attributes/autocomplete/index.md Outdated Show resolved Hide resolved

files/en-us/web/html/element/form/index.md Outdated Show resolved Hide resolved

last few tweaks

796d616

chrisdavidmills closed this Jun 18, 2024

chrisdavidmills reopened this Jun 18, 2024

Merge branch 'main' into add-observatory-docs-to-mdn

75dd4d9

github-actions bot removed the merge conflicts 🚧 label Jun 18, 2024

dipikabh reviewed Jun 18, 2024

View reviewed changes

files/en-us/web/security/practical_implementation_guides/robots_txt/index.md Outdated Show resolved Hide resolved

gene1wood reviewed Jun 18, 2024

View reviewed changes

chrisdavidmills added 2 commits June 19, 2024 12:46

fix broken links

72d7c97

Fixes for gene1wood review comments

0529929

chrisdavidmills requested a review from gene1wood June 19, 2024 12:54

chrisdavidmills added 3 commits June 19, 2024 14:48

Fixes for review comments from freddyb

2875f75

add corp page

02051b8

Merge branch 'main' into add-observatory-docs-to-mdn

2e5a8ee

dipikabh requested changes Jun 19, 2024

View reviewed changes

dipikabh reviewed Jun 19, 2024

View reviewed changes

		Use `robots.txt` to reduce website load and stop unsuitable content appearing in search results.

		Using `robots.txt` is optional and sites should use it only for these purposes. It should not be used as a way to prevent the disclosure of private information or to hide portions of a website. While using this file can prevent these sites from appearing in search engine results, it does not secure websites against attackers who can still determine such details because `robots.txt` is publicly accessible.

	- : Cookies should be set to the most restrictive `Path` possible; for most applications, this will be set to the root directory.
	- : Cookies should be set to the most restrictive `Path` possible.


		## Problem

		Cookies often contain session identifiers or other sensitive information. Unwanted access to cookies, therefore, can cause a host of problems, including [privacy](/en-US/docs/Web/Privacy) issues, ({{Glossary("Cross-site_scripting", "Cross-site scripting (XSS)")}}) attacks, Cross-site request forgery ([CSRF](/en-US/docs/Glossary/CSRF)) attacks, and more.


		## Problem

		Attackers can modify the contents of JavaScript libraries hosted on content delivery networks (CDNs), creating vulnerabilities in all websites that use these libraries.

	Attackers can modify the contents of JavaScript libraries hosted on content delivery networks (CDNs), creating vulnerabilities in all websites that use these libraries.
	If an attacker exploited a content delivery network (CDN) and modified the contents of JavaScript libraries hosted on that CDN, it would create vulnerabilities in all websites that use those libraries.


		### Solution

		HTTP [`Strict-Transport-Security`](/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security) (HSTS) is an HTTP header that notifies browsers to connect to a given site only over HTTPS, even if the originally specified scheme was HTTP. Browsers with HSTS set for a given site will automatically upgrade all requests to HTTPS. HSTS also tells browsers to treat TLS and certificate-related errors more strictly by disabling the ability to bypass the error page.

	- : Specifies whether browsers should upgrade requests on all subdomains to HTTPS. For example, setting `includeSubDomains` on `domain.example.com` will ensure that requests to `host1.domain.example.com` and `host2.domain.example.com` are upgraded.
	- : Specifies whether browsers should upgrade requests on all subdomains to HTTPS. For example, setting `includeSubDomains` on `domain.example.com` will ensure that requests to `host1.domain.example.com` and `host2.domain.example.com` are also upgraded in addition to `domain.example.com`.

	- : Specifies whether the site should be preloaded. Including this directive means your site will be included in the [HSTS preload list](https://hstspreload.org/).
	- : Specifies whether the site should be preloaded. Including this directive means your site can be included in the [HSTS preload list](https://hstspreload.org/).


		{{QuickLinksWithSubpages("/en-US/docs/Web/Security")}}

		Users frequently input sensitive data on websites, such as names, addresses, and banking details. As a web developer, it's crucial to protect this information from bad actors who use a wide range of exploits to steal such information and use it for personal gain. The focus of [web security](/en-US/docs/Web/Security) is to help you protect your website against these exploits and secure your users' sensitive data.

	\| TLS: [HSTS implementation](/en-US/docs/Web/Security/Practical_implementation_guides/TLS#http_strict_transport_security_implementation) \| High \| Low \| Yes \| Notify user agents to connect to sites only over HTTPS, even if the original scheme chosen was HTTP, using HTTP Strict transport security (HSTS). \|
	\| TLS: [HSTS implementation](/en-US/docs/Web/Security/Practical_implementation_guides/TLS#http_strict_transport_security_implementation) \| High \| Low \| Yes \| Notify user agents to connect to sites only over HTTPS, even if the original scheme chosen was HTTP, by using HTTP Strict transport security (HSTS). \|

	\| [CORP implementation](/en-US/docs/Web/Security/Practical_implementation_guides/CORP) \| High \| Medium \| Yes \| Protect against speculative side-channel attacks using Cross-Origin Resource Policy (CORP). \|
	\| [CORP implementation](/en-US/docs/Web/Security/Practical_implementation_guides/CORP) \| High \| Medium \| Yes \| Protect against speculative side-channel attacks by using Cross-Origin Resource Policy (CORP). \|

	\| [CORS configuration](/en-US/docs/Web/Security/Practical_implementation_guides/CORS) \| High \| Low \| Yes \| Define which non-same origins are allowed to access the content of pages and have resources loaded from them with [Cross-Origin Resource Sharing](/en-US/docs/Glossary/CORS) (CORS). \|
	\| [CORS configuration](/en-US/docs/Web/Security/Practical_implementation_guides/CORS) \| High \| Low \| Yes \| Define the non-same origins that are allowed to access the content of pages and have resources loaded from them by using [Cross-Origin Resource Sharing](/en-US/docs/Glossary/CORS) (CORS). \|

	\| [SRI implementation](/en-US/docs/Web/Security/Practical_implementation_guides/SRI) \| Low \| Low \| No \| Verify that fetched resources (for example, from a CDN) are delivered without unexpected manipulation using [Subresource Integrity](/en-US/docs/Glossary/SRI) (SRI). \|
	\| [SRI implementation](/en-US/docs/Web/Security/Practical_implementation_guides/SRI) \| Low \| Low \| No \| Verify that fetched resources (for example, from a CDN) are delivered without unexpected manipulation by using [Subresource Integrity](/en-US/docs/Glossary/SRI) (SRI). \|


		This page lists guides that detail the best practices for implementing security features on websites. While these guides do not cover all possible security scenarios and cannot guarantee complete security of your website, following the information and best practices in these guides will make your sites significantly more secure.

		## Content security fundamentals


		## Solution

		Use `Cross-Origin-Resource-Policy` to block [`no-cors`](/en-US/docs/Web/API/fetch#mode) cross-origin and/or cross-site requests to the given resource. Use the most restrictive value possible for your site: `same-site` or `same-origin` are recommended.


		Use `Cross-Origin-Resource-Policy` to block [`no-cors`](/en-US/docs/Web/API/fetch#mode) cross-origin and/or cross-site requests to the given resource. Use the most restrictive value possible for your site: `same-site` or `same-origin` are recommended.

		As this policy is expressed via a response header, the actual request is not prevented — rather, the browser prevents the result from being leaked by stripping the response body.


		## Examples

		Instruct browsers to disallow cross-origin no-cors requests:


		Using `robots.txt` is optional and sites should use it only for these purposes. It should not be used as a way to prevent the disclosure of private information or to hide portions of a website. While using this file can prevent pages from appearing in search engine results, it does not secure websites against attackers. In fact, it can help them: `robots.txt` is publicly accessible, and by adding your sensitive page paths to it, you are showing attackers exactly where they are.

		Also be aware that some robots will ignore your `robots.txt` file, for example, malware robots and email address harvesters.

	Also be aware that some robots will ignore your `robots.txt` file, for example, malware robots and email address harvesters.
	Also be aware that some robots, such as malware robots and email address harvesters, will ignore your `robots.txt` file.

Add Observatory docs to MDN #33793

Are you sure you want to change the base?

Add Observatory docs to MDN #33793

Conversation

chrisdavidmills commented May 28, 2024 • edited

Description

Motivation

Additional details

Related issues and pull requests

github-actions bot commented May 28, 2024 • edited

github-actions bot commented Jun 13, 2024

chrisdavidmills commented Jun 14, 2024

Choose a reason for hiding this comment

dipikabh left a comment

Choose a reason for hiding this comment

dipikabh left a comment

Choose a reason for hiding this comment

dipikabh Jun 18, 2024 • edited

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

chrisdavidmills Jun 19, 2024 • edited

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

chrisdavidmills commented Jun 19, 2024

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

chrisdavidmills commented May 28, 2024 •

edited

github-actions bot commented May 28, 2024 •

edited

dipikabh Jun 18, 2024 •

edited

chrisdavidmills Jun 19, 2024 •

edited