Web Browsers

7.

Browser Security Architecture

7.1.

Same-Origin Policy

7.1.1.

Origin Definition and Components

7.1.2.

Policy Enforcement Mechanisms

7.1.3.

Cross-Origin Restrictions

7.1.3.1.

Script Access Limitations

7.1.3.2.

Cookie Isolation

7.1.3.3.

Storage Separation

7.1.4.

Exceptions and Relaxations

7.2.

Cross-Origin Resource Sharing (CORS)

7.2.1.

Preflight Request Mechanism

7.2.2.

7.2.2.1.

Access-Control-Allow-Origin

7.2.2.2.

Access-Control-Allow-Methods

7.2.2.3.

Access-Control-Allow-Headers

7.2.3.

Credential Handling

7.2.4.

Security Implications

7.3.

Content Security Policy (CSP)

7.3.1.

Policy Directive Types

7.3.2.

Script Source Control

7.3.3.

Style Source Control

7.3.4.

Image and Media Sources

7.3.5.

Report-Only Mode

7.3.6.

Nonce and Hash-Based Policies

7.4.

Transport Layer Security

7.4.1.

Certificate Authority System

7.4.2.

Certificate Chain Validation

7.4.3.

Certificate Transparency

7.4.4.

HTTP Strict Transport Security (HSTS)

7.4.5.

Certificate Pinning

7.4.6.

Mixed Content Policies

7.5.

Cross-Site Scripting (XSS) Protection

7.5.1.

Reflected XSS Prevention

7.5.2.

Stored XSS Mitigation

7.5.3.

DOM-Based XSS Protection

7.5.4.

XSS Auditor Implementation

7.5.5.

Content Sanitization

7.6.

Cross-Site Request Forgery (CSRF) Protection

7.6.1.

SameSite Cookie Attribute

7.6.2.

CSRF Token Validation

7.6.3.

Referrer Policy Enforcement

7.6.4.

Origin Header Validation

7.7.

Sandboxing and Isolation

7.7.1.

Process Isolation Architecture

7.7.2.

Site Isolation Implementation

7.7.3.

Iframe Sandboxing

7.7.4.

Extension Sandboxing

7.7.5.

Native Client (NaCl) Sandboxing

7.8.

Privacy Protection

7.8.1.

Third-Party Cookie Blocking

7.8.2.

Tracking Prevention

7.8.3.

Fingerprinting Protection

7.8.4.

Private Browsing Mode

7.8.5.

Do Not Track Implementation

7.9.

Permissions Management

7.9.1.

7.9.2.

Geolocation Permissions

7.9.3.

Camera and Microphone Access

7.9.4.

Notification Permissions

7.9.5.

Persistent Storage Permissions

Previous

6. Web APIs and Browser Interfaces

Go to top

Next

8. Data Storage and Management