Defensive Design Article

[manuelvsousa]

In PR #16 we introduced motivations for a Defensive Design Article where we believe, this particular article should be the result of a community effort from both companies (which fix these bugs) and researchers (which get reported bugs fixed).

Here some of the ideas for this article:

• The way applications they use iframes to display information based on a user query (search system)
• How applications use Fetch Metadata with Vary headers to prevent cache probing attacks and what problems might occur with improper deployments. Are there any drawbacks of deploying this?
• How to ensure all application endpoints implement certain Headers to have the same behavior across different states.
• Quick strategies to mitigate reported XS-Leaks, as a short-term solution before deploying web platform security features.