Protect your resources from web attacks with Fetch Metadata | Articles | web.dev

Why should you care about isolating your web resources? Many web applications are vulnerable to cross-origin attacks like cross-site request forgery (CSRF), cross-site script inclusion (XSSI), timing attacks, cross-origin information leaks or speculative execution side-channel (Spectre) attacks. Fetch Metadata request headers allow you to deploy a strong defense-in-depth mechanism—a Resource Isola

[efcl]

Fetch Metadataの`Sec-Fetch-*`ヘッダの解説。 Same-OriginとCross-Siteの区別、それぞれの`Sec-Fetch-*`ヘッダの解説、クロスサイトリクエストを使った攻撃の判定と対策などについて