← Feed

Posts

• Post #3622189

  We've completed our work on Web Security documentation on @mdn@mastodon.social ! The entire MDN content tree has been reworked and now features in-depth information on: - Attacks - Defenses - Authentication - Threat Modeling ↪️ Blog post https://openwebdocs.org/content/posts/security-docs-sovereign-tech-agency/

• Post #1578372

  We've updated MDN's guide on Subresource Integrity (SRI) and added docs for the HTML `integrity` attribute. The SRI docs now talk about the fact that you can provide multiple `integrity` values (using the same or different hash functions) and how browsers will handle that. Thanks to @codingjoe for your feedback! We're looking forward to improved SRI support in @django! https://developer.mozilla.org/en-US/docs/Web/Security/Defenses/Subresource_Integrity

• Post #1184572

  We've written new MDN security docs on Threat Modeling and provided an example threat model for a (simplified) blog website. Threat modeling is a form of risk assessment in which you create a representation of a system so you can identify relevant security and privacy concerns, understand what can go wrong, and decide how to respond. Many thanks to Hamish Willee and Simone Onofri (@w3cdevs) for your input and reviews! https://developer.mozilla.org/en-US/docs/Web/Security/Threat_modeli...

• Post #991743

  We've written a new guide on Federated Identity (FedCM). The articles helps you to understand what's happening under the surface when a website works with an identity provider (IdP) to add federated sign-in for their users. We cover the main flows as defined in the OpenID Connect (OIDC) protocol and its security features. We also present how the FedCM API helps with moving away from third party cookies, and we list some strengths and weaknesses of Federated Identity. https:/...

• Post #991742

  RE: https://mas.to/@patrickbrosset/115695467325719901 In 2025, we systematically collected compat data for 28 browser releases: Firefox 135 - 147 Chrome 133 - 144 Safari 18.4, 26, 26.2 We're keeping your compat tables up-to-date.

• Post #991739

  We've written a new guide on Passkeys! Passkeys address many of the most serious weaknesses of other authentication methods. In this guide we will: - Introduce you to the WebAuthn API - Go through registration and sign-in flows - Give an overview of the security properties of passkeys - Provide you with guidance on managing passkeys as well as migrating from passwords. https://developer.mozilla.org/en-US/docs/Web/Security/Authentication/Passkeys Thanks to Hamish Willee and Simone O...

• Post #991738

  Open Web Docs 2025 Report We're reflecting on our fifth year of ensuring the long-term health of web platform documentation. Happy 5-year anniversary to us! 🍰 Thanks to the many individuals and organizations for your support on our journey! 💜 https://openwebdocs.org/content/reports/2025/

• Post #991737

  Hey @niklasmerz, thank you so much for your kind donation to Open Web Docs! 💜 It's always a pleasure talking to you about WebViews and figuring out compat data for https://caniwebview.com/ Everyone, join the W3C WebView CG to be part of WebView conversations: https://www.w3.org/groups/cg/webview/

• Post #991735

  Thanks to 108 of you who responded to the W3C SWAG CG survey on web security features! 77% said they are responsible themselves for implementing web security features and practices. 23% delegate this work to security specialists. Wondering: Do you delegate risk analysis work, like Threat Modeling, to security specialists, or do you do that yourself, too?

• Post #991734

  We've written a new guide on Session Management! Once you authenticated your users, you will need to manage their sessions. This guide walks you through two different architectures for session management (cookies and JWTs) and describes common session attacks to watch out for. For now, this is the final article in our series on authentication on the Web :) https://developer.mozilla.org/en-US/docs/Web/Security/Authentication/Session_management

• Post #920416

  We've written a new guide on Fetch Metadata! Fetch metadata is a group of HTTP request headers. They tell you if requests are navigation between documents, request for a subresource, or requests made from JavaScript, and whether they are same-origin, or same-site, or from completely different sites. Thanks to this information, you can implement defenses against cross-origin attacks such as cross-site request forgeries (CSRF) and various cross-site leaks. https://developer.mozilla.or...

• Post #715788

  RE: https://front-end.social/@floscholz/116239816080097515 Catch Daniel and Florian at @FOSSBackstage today and tomorrow!

• Post #545152

  Do you delegate web security to security specialists or are you responsible yourself for implementing web security features and practices? The W3C SWAG CG survey asks this and other questions and we would value your input as we create Web Security documentation. https://docs.google.com/forms/d/e/1FAIpQLScbKJL2Q8XABAHVystmqGU2lQoE0tAJSL_dwhvwPwBcJ-M4fQ/viewform?usp=header