Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add Observatory docs to MDN #33793

Merged
merged 68 commits into from
Jun 24, 2024
Merged
Show file tree
Hide file tree
Changes from 54 commits
Commits
Show all changes
68 commits
Select commit Hold shift + click to select a range
4703db1
Restructure security landing page
chrisdavidmills May 28, 2024
c04092c
Retitle and redirect Security your site page to Practical implementat…
chrisdavidmills May 28, 2024
5254100
Update files/en-us/web/security/index.md
chrisdavidmills May 28, 2024
c39da2b
Update files/en-us/web/security/index.md
chrisdavidmills May 28, 2024
c7a383a
initial draft of all Observatory pages
chrisdavidmills May 30, 2024
3164d32
Merge branch 'add-observatory-docs-to-mdn' of github.com:chrisdavidmi…
chrisdavidmills May 30, 2024
06d0b98
Update files/en-us/web/security/practical_implementation/clickjacking…
chrisdavidmills May 30, 2024
cc8a1bb
Update files/en-us/web/security/practical_implementation/clickjacking…
chrisdavidmills May 30, 2024
d7d47c7
Update files/en-us/web/security/practical_implementation/cookies/inde…
chrisdavidmills May 30, 2024
64dd386
Update files/en-us/web/security/practical_implementation/clickjacking…
chrisdavidmills May 30, 2024
0dc7334
Update files/en-us/web/security/practical_implementation/cookies/inde…
chrisdavidmills May 30, 2024
883d4a5
Update files/en-us/web/security/practical_implementation/referrer_pol…
chrisdavidmills May 30, 2024
68659ec
Update files/en-us/web/security/practical_implementation/referrer_pol…
chrisdavidmills May 30, 2024
8c03637
Update files/en-us/web/security/practical_implementation/sri/index.md
chrisdavidmills May 30, 2024
189313e
Update files/en-us/web/security/practical_implementation/sri/index.md
chrisdavidmills May 30, 2024
460025c
Update files/en-us/web/security/practical_implementation/tls/index.md
chrisdavidmills May 30, 2024
ec81406
Update files/en-us/web/security/practical_implementation/cookies/inde…
chrisdavidmills May 30, 2024
74ab66d
Update files/en-us/web/security/practical_implementation/cookies/inde…
chrisdavidmills May 30, 2024
dbeb415
Update files/en-us/web/security/practical_implementation/cors/index.md
chrisdavidmills May 30, 2024
0d277b9
Update files/en-us/web/security/practical_implementation/cors/index.md
chrisdavidmills May 30, 2024
d01abc7
Update files/en-us/web/security/practical_implementation/csp/index.md
chrisdavidmills May 30, 2024
63410ca
Update files/en-us/web/security/practical_implementation/csp/index.md
chrisdavidmills May 30, 2024
612279a
Update files/en-us/web/security/practical_implementation/csp/index.md
chrisdavidmills May 30, 2024
1d6810d
Update files/en-us/web/security/practical_implementation/csp/index.md
chrisdavidmills May 30, 2024
e24c1a2
Update files/en-us/web/security/practical_implementation/csp/index.md
chrisdavidmills May 30, 2024
65a6c43
Update files/en-us/web/security/practical_implementation/csrf_prevent…
chrisdavidmills May 30, 2024
a307fc4
Update files/en-us/web/security/practical_implementation/csrf_prevent…
chrisdavidmills May 30, 2024
309e549
Update files/en-us/web/security/practical_implementation/csrf_prevent…
chrisdavidmills May 30, 2024
7755192
Update files/en-us/web/security/practical_implementation/csrf_prevent…
chrisdavidmills May 30, 2024
a9d6f30
Update files/en-us/web/security/practical_implementation/index.md
chrisdavidmills May 30, 2024
7b437a9
Update files/en-us/web/security/practical_implementation/referrer_pol…
chrisdavidmills May 30, 2024
d7a2d24
Merge branch 'main' into add-observatory-docs-to-mdn
chrisdavidmills May 30, 2024
5b4e224
Fix broken links
chrisdavidmills May 30, 2024
69de9a9
tidy up links on the main practical page
chrisdavidmills May 31, 2024
85916b3
Make sure desired documents are linked to
chrisdavidmills Jun 2, 2024
536fc91
Merge branch 'main' into add-observatory-docs-to-mdn
chrisdavidmills Jun 2, 2024
46e7951
Add a few details to make sure the page align with the test results
chrisdavidmills Jun 3, 2024
c43f8ea
Merge branch 'main' into add-observatory-docs-to-mdn
chrisdavidmills Jun 3, 2024
8d68d09
fixes for dipikabh review comments
chrisdavidmills Jun 7, 2024
cfa0529
Update files/en-us/web/security/practical_implementation/index.md
chrisdavidmills Jun 7, 2024
b19f5e2
Update files/en-us/web/security/practical_implementation_guides/index.md
chrisdavidmills Jun 7, 2024
8ded9c2
Update files/en-us/web/security/practical_implementation_guides/index.md
chrisdavidmills Jun 7, 2024
d828218
remove old version of guide landing page
chrisdavidmills Jun 10, 2024
93eca1a
tweak redirects
chrisdavidmills Jun 10, 2024
35c1c3b
More fixes for dipikabh review comments
chrisdavidmills Jun 10, 2024
6da1616
Update files/en-us/web/security/practical_implementation_guides/index.md
chrisdavidmills Jun 10, 2024
66f47fe
Fix latest round of dipika review comments, and fix some links
chrisdavidmills Jun 12, 2024
74eae48
Making fixes for review comments from dipika and tibap
chrisdavidmills Jun 14, 2024
d7375f5
Update files/en-us/web/security/practical_implementation_guides/csrf_…
chrisdavidmills Jun 14, 2024
006f2f7
Update files/en-us/web/security/practical_implementation_guides/index.md
chrisdavidmills Jun 14, 2024
e18b08f
Update files/en-us/web/security/practical_implementation_guides/index.md
chrisdavidmills Jun 14, 2024
26e178a
Update files/en-us/web/security/practical_implementation_guides/tls/i…
chrisdavidmills Jun 14, 2024
796d616
last few tweaks
chrisdavidmills Jun 18, 2024
75dd4d9
Merge branch 'main' into add-observatory-docs-to-mdn
caugner Jun 18, 2024
72d7c97
fix broken links
chrisdavidmills Jun 19, 2024
0529929
Fixes for gene1wood review comments
chrisdavidmills Jun 19, 2024
2875f75
Fixes for review comments from freddyb
chrisdavidmills Jun 19, 2024
02051b8
add corp page
chrisdavidmills Jun 19, 2024
2e5a8ee
Merge branch 'main' into add-observatory-docs-to-mdn
chrisdavidmills Jun 19, 2024
bfda732
Update CSRF XSS link
chrisdavidmills Jun 20, 2024
f7c14a7
few more fixes for freddy and dipika comments
chrisdavidmills Jun 20, 2024
a692710
Correct HTTP observatory naming issues
chrisdavidmills Jun 20, 2024
0a76c93
Improve CORP page
chrisdavidmills Jun 20, 2024
762d53f
Add xs-leaks info and link
chrisdavidmills Jun 20, 2024
3aa78fd
Couple more fixes for gene wood comments
chrisdavidmills Jun 20, 2024
abc565f
fixes for freddyb comments
chrisdavidmills Jun 21, 2024
83a03ca
Fixes to SameSite directive descriptions
chrisdavidmills Jun 23, 2024
7f7ac0e
Merge branch 'main' into add-observatory-docs-to-mdn
chrisdavidmills Jun 23, 2024
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 4 additions & 2 deletions files/en-us/_redirects.txt
Original file line number Diff line number Diff line change
Expand Up @@ -3991,7 +3991,7 @@
/en-US/docs/HTTP_Pipelining_FAQ /en-US/docs/Web/HTTP/Connection_management_in_HTTP_1.x
/en-US/docs/HTTP_Transaction_Model /en-US/docs/Web/HTTP
/en-US/docs/HTTP_access_control /en-US/docs/Web/HTTP/CORS
/en-US/docs/How_to_Turn_Off_Form_Autocompletion /en-US/docs/Web/Security/Securing_your_site/Turning_off_form_autocompletion
/en-US/docs/How_to_Turn_Off_Form_Autocompletion /en-US/docs/Web/Security/Practical_implementation_guides/Turning_off_form_autocompletion
/en-US/docs/How_to_check_the_security_state_of_an_XMLHTTPRequest_over_SSL /en-US/docs/Web/API/XMLHttpRequest
/en-US/docs/How_to_create_a_DOM_tree /en-US/docs/Web/API/Document_Object_Model/Using_the_Document_Object_Model
/en-US/docs/How_to_start_contributions_to_Mozilla /en-US/docs/MDN/Community/Contributing/Getting_started
Expand Down Expand Up @@ -6793,7 +6793,7 @@
/en-US/docs/Security/MixedContent/fix_website_with_mixed_content /en-US/docs/Web/Security/Mixed_content#developer_console
/en-US/docs/Security/Mixed_content /en-US/docs/Web/Security/Mixed_content
/en-US/docs/Security/Mixed_content/How_to_fix_website_with_mixed_content /en-US/docs/Web/Security/Mixed_content#developer_console
/en-US/docs/Security/Securing_your_site /en-US/docs/Web/Security/Securing_your_site
/en-US/docs/Security/Securing_your_site /en-US/docs/Web/Security/Practical_implementation_guides
/en-US/docs/Security/Weak_Signature_Algorithm /en-US/docs/Web/Security/Weak_Signature_Algorithm
/en-US/docs/Security_changes_in_Firefox_3.1 /en-US/docs/Mozilla/Firefox/Releases/3.5/Security_changes
/en-US/docs/Security_changes_in_Firefox_3.5 /en-US/docs/Mozilla/Firefox/Releases/3.5/Security_changes
Expand Down Expand Up @@ -13024,7 +13024,9 @@
/en-US/docs/Web/Security/HTTP_strict_transport_security /en-US/docs/Web/HTTP/Headers/Strict-Transport-Security
/en-US/docs/Web/Security/Mixed_content/How_to_fix_website_with_mixed_content /en-US/docs/Web/Security/Mixed_content#developer_console
/en-US/docs/Web/Security/Public_Key_Pinning /en-US/docs/Web/Security/Certificate_Transparency
/en-US/docs/Web/Security/Securing_your_site /en-US/docs/Web/Security/Practical_implementation_guides
/en-US/docs/Web/Security/Securing_your_site/Configuring_server_MIME_types /en-US/docs/Learn/Server-side/Configuring_server_MIME_types
/en-US/docs/Web/Security/Securing_your_site/Turning_off_form_autocompletion /en-US/docs/Web/Security/Practical_implementation_guides/Turning_off_form_autocompletion
/en-US/docs/Web/WebGL /en-US/docs/Web/API/WebGL_API
/en-US/docs/Web/WebGL/Adding_2D_content_to_a_WebGL_context /en-US/docs/Web/API/WebGL_API/Tutorial/Adding_2D_content_to_a_WebGL_context
/en-US/docs/Web/WebGL/Animating_objects_with_WebGL /en-US/docs/Web/API/WebGL_API/Tutorial/Animating_objects_with_WebGL
Expand Down
132 changes: 66 additions & 66 deletions files/en-us/_wikihistory.json
Original file line number Diff line number Diff line change
Expand Up @@ -126844,6 +126844,72 @@
"evilpie"
]
},
"Web/Security/Practical_implementation": {
"modified": "2020-06-03T13:43:23.202Z",
"contributors": [
"jswisher",
"mfuji09",
"germain",
"sideshowbarker",
"patizenyapetshop",
"larsonreever",
"SebastienParis",
"tlubitz",
"david_ross",
"mbm",
"chrisdavidmills",
"JazibZaman",
"hashedhyphen",
"marumari",
"evilpie",
"Sheppy",
"teoli"
]
},
"Web/Security/Practical_implementation/Turning_off_form_autocompletion": {
"modified": "2020-07-10T21:28:54.938Z",
"contributors": [
"patrickhlauke",
"mfuji09",
"mnoorenberghe",
"leela52452",
"jswisher",
"sruthiveeragandham",
"Nomeh_Uchenna_Gabriel",
"mfluehr",
"WilliamC07",
"hjuhlin",
"chrisdavidmills",
"LouisLazaris",
"devinea2",
"steduardo",
"terrylinooo",
"kbagot",
"stutrek",
"Didglee",
"rottina",
"Delapouite",
"wbamberg",
"John99",
"Manishearth",
"Sheppy",
"ConcreteGannet",
"teoli",
"contrebis",
"dhodder",
"David-Sarah Hopwood",
"George3",
"LonelyPixel",
"Brianegge",
"NickolayBot",
"Andreas Wuest",
"Brycenesbitt",
"Callek",
"VicMan",
"Pmsyyz",
"Mathieu Deaudelin"
]
},
"Web/Security/Referer_header:_privacy_and_security_concerns": {
"modified": "2020-07-22T14:05:46.803Z",
"contributors": [
Expand Down Expand Up @@ -126948,72 +127014,6 @@
"Annevk"
]
},
"Web/Security/Securing_your_site": {
"modified": "2020-06-03T13:43:23.202Z",
"contributors": [
"jswisher",
"mfuji09",
"germain",
"sideshowbarker",
"patizenyapetshop",
"larsonreever",
"SebastienParis",
"tlubitz",
"david_ross",
"mbm",
"chrisdavidmills",
"JazibZaman",
"hashedhyphen",
"marumari",
"evilpie",
"Sheppy",
"teoli"
]
},
"Web/Security/Securing_your_site/Turning_off_form_autocompletion": {
"modified": "2020-07-10T21:28:54.938Z",
"contributors": [
"patrickhlauke",
"mfuji09",
"mnoorenberghe",
"leela52452",
"jswisher",
"sruthiveeragandham",
"Nomeh_Uchenna_Gabriel",
"mfluehr",
"WilliamC07",
"hjuhlin",
"chrisdavidmills",
"LouisLazaris",
"devinea2",
"steduardo",
"terrylinooo",
"kbagot",
"stutrek",
"Didglee",
"rottina",
"Delapouite",
"wbamberg",
"John99",
"Manishearth",
"Sheppy",
"ConcreteGannet",
"teoli",
"contrebis",
"dhodder",
"David-Sarah Hopwood",
"George3",
"LonelyPixel",
"Brianegge",
"NickolayBot",
"Andreas Wuest",
"Brycenesbitt",
"Callek",
"VicMan",
"Pmsyyz",
"Mathieu Deaudelin"
]
},
"Web/Security/Subdomain_takeovers": {
"modified": "2020-08-25T23:27:57.222Z",
"contributors": ["jswisher"]
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -494,8 +494,8 @@ To prevent referrer leakage entirely, specify the `no-referrer` value instead. N

Use services like the ones below to check your `Referrer-Policy`:

- [MDN Observatory](/en-US/observatory/)
- [securityheaders.com](https://securityheaders.com/)
- [Mozilla Observatory](https://observatory.mozilla.org/)

```apacheconf
<IfModule mod_headers.c>
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -181,7 +181,7 @@ The next and final step in this module about Django is to complete the [assessme
## See also

- [Security in Django](https://docs.djangoproject.com/en/5.0/topics/security/) (Django docs)
- [Server side website security](/en-US/docs/Web/Security) (MDN)
- [Securing your site](/en-US/docs/Web/Security/Securing_your_site) (MDN)
- [Security on the web](/en-US/docs/Web/Security) (MDN)
- [Practical security implementation guides](/en-US/docs/Web/Security/Practical_implementation_guides) (MDN)

{{PreviousMenuNext("Learn/Server-side/Django/Deployment", "Learn/Server-side/Django/django_assessment_blog", "Learn/Server-side/Django")}}
4 changes: 2 additions & 2 deletions files/en-us/web/html/attributes/autocomplete/index.md
Original file line number Diff line number Diff line change
Expand Up @@ -50,7 +50,7 @@ The attribute value is either the keyword `off` or `on`, or a space-separated `<

- : The browser is not permitted to automatically enter or select a value for this field. It is possible that the document or application provides its own autocomplete feature, or that security concerns require that the field's value not be automatically entered.

> **Note:** In most modern browsers, setting `autocomplete` to "`off`" will not prevent a password manager from asking the user if they would like to save username and password information, or from automatically filling in those values in a site's login form. See [the autocomplete attribute and login fields](/en-US/docs/Web/Security/Securing_your_site/Turning_off_form_autocompletion#the_autocomplete_attribute_and_login_fields).
> **Note:** In most modern browsers, setting `autocomplete` to "`off`" will not prevent a password manager from asking the user if they would like to save username and password information, or from automatically filling in those values in a site's login form. See [Managing autofill for login fields](/en-US/docs/Web/Security/Practical_implementation_guides/Turning_off_form_autocompletion#managing_autofill_for_login_fields).

- `on`

Expand Down Expand Up @@ -86,7 +86,7 @@ The attribute value is either the keyword `off` or `on`, or a space-separated `<
- "`username`"
- : A username or account name.
- "`new-password`"
- : A new password. When creating a new account or changing passwords, this should be used for an "Enter your new password" or "Confirm new password" field, as opposed to a general "Enter your current password" field that might be present. This may be used by the browser both to avoid accidentally filling in an existing password and to offer assistance in creating a secure password (see also [Preventing autofilling with autocomplete="new-password"](/en-US/docs/Web/Security/Securing_your_site/Turning_off_form_autocompletion#preventing_autofilling_with_autocompletenew-password)).
- : A new password. When creating a new account or changing passwords, this should be used for an "Enter your new password" or "Confirm new password" field, as opposed to a general "Enter your current password" field that might be present. This may be used by the browser both to avoid accidentally filling in an existing password and to offer assistance in creating a secure password.
- "`current-password`"
- : The user's current password.
- "`one-time-code`"
Expand Down
2 changes: 1 addition & 1 deletion files/en-us/web/html/element/form/index.md
Original file line number Diff line number Diff line change
Expand Up @@ -36,7 +36,7 @@ This element includes the [global attributes](/en-US/docs/Web/HTML/Global_attrib

- : Indicates whether input elements can by default have their values automatically completed by the browser. `autocomplete` attributes on form elements override it on `<form>`. Possible values:

- `off`: The browser may not automatically complete entries. (Browsers tend to ignore this for suspected login forms; see [The autocomplete attribute and login fields](/en-US/docs/Web/Security/Securing_your_site/Turning_off_form_autocompletion#the_autocomplete_attribute_and_login_fields).)
- `off`: The browser may not automatically complete entries. (Browsers tend to ignore this for suspected login forms; see [Managing autofill for login fields](/en-US/docs/Web/Security/Practical_implementation_guides/Turning_off_form_autocompletion#managing_autofill_for_login_fields).)
- `on`: The browser may automatically complete entries.

- `name`
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -72,8 +72,7 @@ X-Content-Type-Options: nosniff

- {{HTTPHeader("Content-Type")}}
- The [original definition](https://docs.microsoft.com/archive/blogs/ie/ie8-security-part-vi-beta-2-update) of X-Content-Type-Options by Microsoft.
- The [Mozilla Observatory](https://observatory.mozilla.org/) tool testing
the configuration (including this header) of websites for safety and security
- Use [MDN Observatory](/en-US/observatory/) to test the security configuration of websites (including this header).
- [Mitigating MIME Confusion Attacks in Firefox](https://blog.mozilla.org/security/2016/08/26/mitigating-mime-confusion-attacks-in-firefox/)
- [Cross-Origin Read Blocking (CORB)](https://fetch.spec.whatwg.org/#corb)
- [Google Docs CORB explainer](https://chromium.googlesource.com/chromium/src/+/master/services/network/cross_origin_read_blocking_explainer.md)
Loading