The purpose of this page is to establish a concise and consistent approach to secure application development of Mozilla web applications and web services. The information provided here will be focused towards web based applications; however, the concepts can be universally applied to applications to implement sound security controls and design.
Advanced web security topics
(Updated 22 May 2020) This post discusses web security issues that I come across – so far thankfully mostly by reading about them. It is a work in progress which I’ll keep updating. The…
arkenfox/user.js
Firefox privacy, security and anti-tracking: a comprehensive user.js template for configuration and hardening
Introducing WEBCAT: Web-based Code Assurance and Transparency
In this post, we introduce Web-based Code Assurance and Transparency, a project that supports verifiable in-browser code for single-page browser applications. Along with this post, we are publishing the WEBCAT project repository; follow-up posts will provide more detailed information.
Isolated Web Apps · Issue #799 · mozilla/standards-positions
Request for Mozilla Position on an Emerging Web Specification Specification Title: Isolated Web Apps Specification or proposal URL (if available): Explainer URL (if available): https://github.com/W...
Make the Web Work For Everyone – Mozilla Hacks - the Web developer blog
Updated 2016/07/22: Commenters found a few data errors (thanks!) which have now been corrected. Millions of websites have compatibility problems on one or more of the major browsers, leading to ...
Webxdc: mini apps shared in a chat
Secure mini apps for chats. No internet access, no tracking, no servers.
Isolated Web Apps · Issue #842 · w3ctag/design-reviews
こんにちは TAG-さん! I'm requesting a TAG review of Isolated Web Apps. This proposal provides a way to build applications using web technologies that will have useful security properties unavailable t...
Reducing XSS by way of Automatic Context-Aware Escaping in Template Systems
Posted by Jad S. Boutros, Security Team Building on our earlier posts on defenses against web application flaws [ "Automating Web Applicatio...
WEBCAT - Verifiable Code for the Web
WEBCAT helps people trust the websites they use by making it possible to verify the code running in their browser.
Digital Credentials · Issue #1003 · mozilla/standards-positions
Request for Mozilla Position on an Emerging Web Specification Specification title: Digital Credentials Specification or proposal URL (if available): https://wicg.github.io/digital-identities/ Expla...
A cartoon intro to DNS over HTTPS – Mozilla Hacks - the Web developer blog
At Mozilla, we closely track threats to users' privacy and security. This is why we've added tracking protection to Firefox and created the Facebook container extension. In today's cartoon intro, ...
Keeping Data Private | Web Browser Engineering
Our browser has grown up and now runs (small) web applications. With one final step—user identity via cookies—it will be able to run all sorts of personalized online services. But capability demands responsibility: our browser must now secure cookies against adversaries interested in stealing them. Luckily, browsers have sophisticated systems for controlling access to cookies and preventing their misuse.
w3c/trusted-types
A browser API to prevent DOM-Based Cross Site Scripting in modern web applications.
Help us test WEBCAT alpha
Web applications are only as trustworthy as the servers that serve them, and servers can get hacked. So, last year, we introduced WEBCAT (Web-Based Code Assurance and Transparency), a project designed to enable verifiable in-browser code for web applications. We wrote extensively about WEBCAT’s requirements, constraints, and goals.Today, we’re excited to announce the alpha release of WEBCAT. In particular, we invite community participation in a new, decentralized enrollment infrastructure.
Web Crypto’s SubtleCrypto: A Masterclass in Developer Hostility and How It Strangles the Modern Web
Not Subtle, Just Sabotage — An API Against the Web