Glossary

CORS is how a server allows another origin to read its responses. What the headers mean, why wildcards and credentials conflict, and what it is not.

A preflight asks permission before sending a cross-origin request that could change state. What triggers one, and how to stop paying for it twice.

Rate limiting caps request frequency per client. The common algorithms, the standard response headers, and what it does and does not defend.

A JWT carries claims in a signed, base64-encoded structure. Why it is readable by anyone, and why revocation is its hardest problem.

ads.txt lists the companies authorised to sell a site's advertising. How buyers use it, what each field means, and what app-ads.txt adds.

A cookie is a small value a server stores in a browser and receives back on later requests. The attributes that govern it, and what each one controls.

The SameSite attribute decides whether a cookie is sent on cross-site requests. The three values, the default, and what it defends against.

WebP is smaller than JPEG and PNG at comparable quality and is supported everywhere. What it replaces, what it does not, and how to serve it safely.

AVIF compresses better than WebP and JPEG, with wide-gamut and HDR support. What it costs to encode, and when the extra saving is worth it.

Responsive images let the browser choose a file matched to the display. How srcset and sizes work together, and when picture is needed instead.

How srcset and sizes work together, why a srcset without sizes usually changes nothing, and the difference between width and density descriptors.

What the picture element does that srcset cannot — art direction and format fallback — and why the order of its sources decides the outcome.

How width and height attributes let a browser reserve space, why that stopped conflicting with responsive CSS, and what a ratio mismatch causes.

How an image service differs from a plain CDN, what it removes from a build pipeline, and the caching and cost questions it introduces.

A reverse proxy receives requests on behalf of an origin. What it handles, what it changes about headers and addresses, and what it hides.

The origin is the server that generates a site's responses. Why an exposed origin undoes a CDN, and how origins are discovered.

A third-party cookie is set by a resource from a different site than the page. Why browsers are removing them, and what replaces the uses that remain.

Cookie consent is permission sought before non-essential storage. What the observable requirements are, and the common implementation failure.

The same-origin policy stops one site reading another's data in the browser. What an origin is, what the policy blocks, and what it deliberately does not.

nosniff tells the browser to trust the declared content type. What it prevents, what it can break, and why it is the cheapest header to set.

X-Frame-Options stops a page being embedded in a frame. Its two useful values, why ALLOW-FROM does not work, and what replaces it.

Clickjacking overlays an invisible page so a click lands somewhere the visitor cannot see. How it works, and the two headers that stop it.

Referrer-Policy decides how much of the current URL is sent when a visitor follows a link. The useful values, and what full URLs can disclose.

Permissions-Policy declares which browser features a page and its frames may use. What it controls, and why it is a containment measure.

COOP isolates a document from windows that opened it or that it opens. What it prevents, what it breaks, and why it enables cross-origin isolation.

CORP lets a resource declare which origins may load it at all. How it differs from CORS, and why it exists as a side-channel defence.

security.txt publishes contact details for security reports at a known path. What the fields are, why Expires is mandatory, and where it belongs.

RFC 8615 reserves /.well-known/ for site-wide metadata at predictable paths. What lives there, and why the namespace is registered.

A source map lets a debugger show original code behind a minified bundle. Why publishing one can disclose the whole codebase, and how to control it.

A WAF inspects HTTP requests and blocks ones matching attack patterns. What it catches, what it misses, and why it is not a substitute for fixing code.

MFA requires evidence from more than one category. Why the factors differ in strength, and which are resistant to phishing.

SSO delegates authentication to one identity provider. How SAML and OpenID Connect differ, and what centralising identity concentrates.

Directory listing shows a folder's contents when no index file exists. What it exposes, why it is usually accidental, and how to switch it off.

CSP tells the browser where a page may load resources from. Why unsafe-inline defeats it, and how report-only mode makes deployment survivable.

Why services issue publishable and private keys, how a private one ends up in a browser bundle, and why rotation is the only real remedy.

How an integrity attribute lets a browser refuse a script that has changed, why it only suits pinned versions, and what it does not protect against.

How a cross-site request uses a browser's own cookies, why SameSite changed the picture, and which mitigations are observable from outside.

What cross-site scripting is, why output encoding rather than input filtering is the fix, and which of its mitigations an external scan can see.

How credential stuffing differs from guessing, why rate limiting alone does not stop it, and which observable signals bear on a site's exposure.

How a passkey replaces a password with a key pair, why it removes phishing and reuse as categories, and what it changes about account recovery.