Web Browsers

  1. Browser Security Architecture
    1. Same-Origin Policy
      1. Origin Definition and Components
        1. Policy Enforcement Mechanisms
          1. Cross-Origin Restrictions
            1. Script Access Limitations
              1. Storage Separation
              2. Exceptions and Relaxations
              3. Cross-Origin Resource Sharing (CORS)
                1. Preflight Request Mechanism
                  1. CORS Headers
                    1. Access-Control-Allow-Origin
                      1. Access-Control-Allow-Methods
                        1. Access-Control-Allow-Headers
                        2. Credential Handling
                          1. Security Implications
                          2. Content Security Policy (CSP)
                            1. Policy Directive Types
                              1. Script Source Control
                                1. Style Source Control
                                  1. Image and Media Sources
                                    1. Report-Only Mode
                                      1. Nonce and Hash-Based Policies
                                      2. Transport Layer Security
                                        1. Certificate Authority System
                                          1. Certificate Chain Validation
                                            1. Certificate Transparency
                                              1. HTTP Strict Transport Security (HSTS)
                                                1. Certificate Pinning
                                                  1. Mixed Content Policies
                                                  2. Cross-Site Scripting (XSS) Protection
                                                    1. Reflected XSS Prevention
                                                      1. Stored XSS Mitigation
                                                        1. DOM-Based XSS Protection
                                                          1. XSS Auditor Implementation
                                                            1. Content Sanitization
                                                            2. Cross-Site Request Forgery (CSRF) Protection
                                                              1. CSRF Token Validation
                                                                1. Referrer Policy Enforcement
                                                                  1. Origin Header Validation
                                                                  2. Sandboxing and Isolation
                                                                    1. Process Isolation Architecture
                                                                      1. Site Isolation Implementation
                                                                        1. Iframe Sandboxing
                                                                          1. Extension Sandboxing
                                                                            1. Native Client (NaCl) Sandboxing
                                                                            2. Privacy Protection
                                                                              1. Tracking Prevention
                                                                                1. Fingerprinting Protection
                                                                                  1. Private Browsing Mode
                                                                                    1. Do Not Track Implementation
                                                                                    2. Permissions Management
                                                                                      1. Permission API
                                                                                        1. Geolocation Permissions
                                                                                          1. Camera and Microphone Access
                                                                                            1. Notification Permissions
                                                                                              1. Persistent Storage Permissions

                                                                                            Previous

                                                                                            6. Web APIs and Browser Interfaces

                                                                                            Go to top

                                                                                            Next

                                                                                            8. Data Storage and Management