.tip

May 1, 2026 · one of the small things

Ship the Content-Security-Policy as Report-Only first

A CSP that is one source short breaks the page for every user at once. The report-only header logs the violations and blocks nothing.

Content-Security-Policy-Report-Only: default-src 'self'; script-src 'self' https://cdn.example.com; report-to csp

Run it for a week, read the reports, fix the sources you forgot, then rename the header. The policy is the same string.

securityhttp

~/tips/today — 2026-09-04

~cat tips/today

Session cookies: HttpOnly, Secure, SameSite=Lax

securityhttp

Three attributes, each closing a class of attack. HttpOnly keeps scripts from reading it. Secure keeps it off plain HTTP. SameSite=Lax stops it being sent on cross-site POSTs, which is most CSRF.

Set-Cookie: session=...; HttpOnly; Secure; SameSite=Lax; Path=/; Max-Age=1209600

Strict breaks arriving from an external link while logged in. Lax is the default worth keeping.

↵ open y yesterday l ls /tips

esc close