Safe DOM manipulation with the Sanitizer API
The new Sanitizer API aims to build a robust processor for arbitrary strings to be safely inserted into a page.
Scaling multithreaded WebAssembly applications with mimalloc and WasmFS
WasmFS and the mimalloc feature in Emscripten can help a lot with allocation and I/O performance. This guide shows how these features can lead to speed improvements of 10 times or more in some cases.
Schemeful Same-Site
The definition of "same-site" is evolving to include the URL scheme, so links between HTTP and HTTPS versions of a site now count as cross-site requests. Upgrade to HTTPS by default to avoid issues where possible or read on for details of what SameSite attribute values are needed.
Script evaluation and long tasks
When loading scripts, it takes time for the browser to evaluate them prior to execution, which can cause long tasks. Learn how script evaluation works, and what you can do to keep it from causing long tasks during page load.
Securely hosting user data in modern web applications
How to securely display user-controlled content on web applications.
What are security attacks?
An insecure application could expose users and systems to various types of damage. When a malicious party uses vulnerabilities or lack of security features to their advantage to cause damage, it is called an attack. We'll take a look at different types of attacks in this guide so you know what to look for when securing your application.
The Credential Management API
Sign in Users
Save Credentials from Forms
Security headers quick reference
This article lists the most important security headers you can use to protect your website. Use it to understand web-based security features, learn how to implement them on your website, and as a reference for when you need a reminder.
Security should not be so scary!
When the word "security" comes to mind, it's usually in the context of bad news. But security is something to be taken as a positive and necessary part of web development just like "user experience" or "accessibility".
Semantics and screen readers
Assistive technologies rely on developers using semantic HTML. But what are semantics, and how do screen readers use them?
Introduction to ARIA
Introduction to ARIA and non-native HTML semantics
Introduction to semantics
Introduction to semantics and assistive technology
Sending messages with web push libraries
Use WebP images
WebP images are smaller than their JPEG and PNG counterparts—usually on the magnitude of a 25–35% reduction in filesize. This decreases page sizes and improves performance.
Serve responsive images
Serving desktop-sized images to mobile devices can use 2–4x more data than needed. Instead of a "one-size-fits-all" approach to images, serve different image sizes to different devices.
Service worker caching and HTTP caching
The pros and cons of using consistent or different expiry logic across the service worker cache and HTTP cache layers.
The service worker lifecycle
A deep-dive into the service worker lifecycle.
Service worker mindset
Working with service workers is new and unfamiliar for many web devs. This post provides some tips for wrapping your mind around them.
Service workers and the Cache Storage API
The browser's HTTP cache is your first line of defense. It's not necessarily the most powerful or flexible approach, and you have limited control over the lifetime of cached responses. But there are several rules of thumb that give you a sensible caching implementation without much work, so you should always try to follow them.
Service worker registration
Best practices for timing your service worker registration.
Setting up a payment method
A payment transaction using Web Payments starts with the discovery of your payment app. Learn how to set up a payment method and get your payment app ready for merchants and customers to make payments.
