Security main page

[wbamberg]

This rewrites the top-level security page. I've made it much more like an index of the pages in this section. I felt a bit bad removing a lot of the guide-type content here, but really it's very incomplete and outdated, so I don't think it is very useful.

[github-actions]

Preview URLs (2 pages)

• /en-US/docs/Web/API/Screen_Capture_API
• /en-US/docs/Web/Security

Flaws (1)

Note! 1 document with no flaws that don't need to be listed. 🎉

Found an unexpected or unresolvable flaw? Please report it here.

URL: /en-US/docs/Web/Security
Title: Security
Flaw count: 1

• broken_links:
  • Link /en-US/docs/Web/Security/Defenses/Input_validation doesn't resolve

External URLs (1)

URL: /en-US/docs/Web/Security
Title: Security

• https://w3c-cg.github.io/swag/docs/swag.html (1 time) (Note! This may be a new URL 👀)

(comment last updated: 2026-06-09 05:02:19)

[hamishwillee]

@wbamberg Added a few nit comments, but this is good. Approving so you can merge when you want.

I felt a bit bad removing a lot of the guide-type content here, but really it's very incomplete and outdated, so I don't think it is very useful.

FWIW absolutely right decision.
What was here was an overview of defences and defensive approaches. That's a potentially useful document to as the first document, if named as such.
What you have here is a much better entry point for presenting the whole Security topic in a structured way.

[wbamberg]

@wbamberg Added a few nit comments, but this is good. Approving so you can merge when you want.

I felt a bit bad removing a lot of the guide-type content here, but really it's very incomplete and outdated, so I don't think it is very useful.

FWIW absolutely right decision. What was here was an overview of defences and defensive approaches. That's a potentially useful document to as the first document, if named as such. What you have here is a much better entry point for presenting the whole Security topic in a structured way.

Yeah, I do wonder if it's worth somewhere having a list of "things everyone should probably be doing":

• use HTTPS
• have a CSP, preferably strict, but minimally disallowing inline JavaScript
• control cross-origin requests using Fetch metadata
• use strong authentication (in particular, not just passwords)
• use secure cookie attributes (Secure, and SameSite=Strict or =Lax if you must)
• follow good operational security practices
• take care of your dependencies
• handle input securely
• restrict framing
• use SRI for external JS

I wasn't sure where it could go but maybe it would work as a top level section in https://developer.mozilla.org/en-US/docs/Web/Security/Defenses ?

[hamishwillee]

I wasn't sure where it could go but maybe it would work as a top level section in https://developer.mozilla.org/en-US/docs/Web/Security/Defenses ?

That is technically the right place for such a doc to go.

But I would still probably try put it as an overview/defensive overview above attacks, as the first thing people see after the index in this page - prefixed with a note that if you do nothing else, this is the essential set of defences.

Obviously pros and cons to both approaches. My leaning is because I tend to think most people stop reading way too early, so getting this in is important. It won't block anyone who really cares from getting the detail.

[hamishwillee]

PS But if it is useful, it doesn't matter where it goes - you can try both places with no significant difference in effort.

[wbamberg]

I wasn't sure where it could go but maybe it would work as a top level section in https://developer.mozilla.org/en-US/docs/Web/Security/Defenses ?

That is technically the right place for such a doc to go.

But I would still probably try put it as an overview/defensive overview above attacks, as the first thing people see after the index in this page - prefixed with a note that if you do nothing else, this is the essential set of defences.

Obviously pros and cons to both approaches. My leaning is because I tend to think most people stop reading way too early, so getting this in is important. It won't block anyone who really cares from getting the detail.

Yeah I take your point. Do you think this is good -> 0e75c1d (plus also 5ab917d, apparently)?

[chrisdavidmills]

As the author of the previous rewrite of this page, I heartily approve of your work here. This is absolutely the right approach now that you have written the deep-dive docs to drill down to.

[hamishwillee]

I'm (very) happy with this. Merge at will.