Important Security Terminology
Two of the hurdles developers face when migrating to HTTPS are concepts and terminology. This guide provides a brief overview of both.
Media encryption
Learn digital rights management concepts, and the commands needed to get from a raw mov file to encrypted media packaged for MPEG-DASH or HLS using both Clear Key or Widevine encryption.
Sign in with a passkey through form autofill
Create a sign in experience that leverages passkeys while still accommodating existing password users.
Designing the user experience of passkeys on Google accounts
Bringing better security and a better user experience to Google accounts.
Check site security
You won't be able to build a PWA without HTTPS. Serving your site over HTTPS is fundamental for security, and many APIs won't work without it. If you need to justify implementation costs, find out why HTTPS matters.
SameSite cookies explained
Learn to mark your cookies for first-party and third-party usage with the SameSite attribute. You can enhance your site's security by using SameSite's Lax and Strict values to improve protection against CSRF attacks. Specifying the new None attribute lets you explicitly mark your cookies for cross-site usage.
What are security attacks?
An insecure application could expose users and systems to various types of damage. When a malicious party uses vulnerabilities or lack of security features to their advantage to cause damage, it is called an attack. We'll take a look at different types of attacks in this guide so you know what to look for when securing your application.
Security headers quick reference
This article lists the most important security headers you can use to protect your website. Use it to understand web-based security features, learn how to implement them on your website, and as a reference for when you need a reminder.
Security should not be so scary!
When the word "security" comes to mind, it's usually in the context of bad news. But security is something to be taken as a positive and necessary part of web development just like "user experience" or "accessibility".
SMS OTP form best practices
Asking a user to provide a one-time password is a common way to confirm a user's identity. Learn best practices to build an SMS OTP form, with great user experience.
Mitigate cross-site scripting (XSS) with a strict Content Security Policy (CSP)
Learn how to deploy a CSP based on script nonces or hashes as a defense-in-depth against cross-site scripting.
Confound malicious middlemen with HTTPS and HTTP Strict transport security
Prevent creating a new passkey if one exists
Learn how to prevent creating a new passkey if one already exists in the user's password manager.
RP ID deep dive
Learn how to configure your RP ID and platform associations to enable seamless passkey authentication across subdomains, multiple sites, and mobile applications.
Passkeys within iframes
Learn how to securely implement passkeys (WebAuthn) within cross-origin iframes using browser security policies and server-side verification.
Why HTTPS matters
HTTPS protects the integrity of your website, protects the privacy and security of your users, and is a prerequisite for new and powerful web platform APIs.
How the BBC is rolling out HSTS for better security and performance.
The BBC is rolling out HSTS for their website to improve security and performance. Find out what it means, and how HSTS can help you.