mastodon 4.7.3Open Web Docs supports web platform documentation for the benefit of web developers & designers worldwide.
We've completed our work on Web Security documentation on @mdn@mastodon.social !
The entire MDN content tree has been reworked and now features in-depth information on:
↪️ Blog post https://openwebdocs.org/content/posts/security-docs-sovereign-tech-agency/
We've written a new guide on Passkeys!
Passkeys address many of the most serious weaknesses of other authentication methods.
In this guide we will:
- Introduce you to the WebAuthn API
- Go through registration and sign-in flows
- Give an overview of the security properties of passkeys
- Provide you with guidance on managing passkeys as well as migrating from passwords.
https://developer.mozilla.org/en-US/docs/Web/Security/Authentication/Passkeys
Thanks to Hamish Willee and Simone Onofri for providing reviews.
We've written new MDN security docs on Threat Modeling and provided an example threat model for a (simplified) blog website.
Threat modeling is a form of risk assessment in which you create a representation of a system so you can identify relevant security and privacy concerns, understand what can go wrong, and decide how to respond.
Many thanks to Hamish Willee and Simone Onofri (@w3cdevs@w3c.social) for your input and reviews!
https://developer.mozilla.org/en-US/docs/Web/Security/Threat_modeling
We've written a new guide on Session Management!
Once you authenticated your users, you will need to manage their sessions.
This guide walks you through two different architectures for session management (cookies and JWTs) and describes common session attacks to watch out for.
For now, this is the final article in our series on authentication on the Web :)
https://developer.mozilla.org/en-US/docs/Web/Security/Authentication/Session_management
Do you delegate web security to security specialists or are you responsible yourself for implementing web security features and practices?
The W3C SWAG CG survey asks this and other questions and we would value your input as we create Web Security documentation.
Open Web Docs 2025 Report
We're reflecting on our fifth year of ensuring the long-term health of web platform documentation.
Happy 5-year anniversary to us! 🍰
Thanks to the many individuals and organizations for your support on our journey! 💜
We've written a new guide on Fetch Metadata!
Fetch metadata is a group of HTTP request headers.
They tell you if requests are navigation between documents, request for a subresource, or requests made from JavaScript, and whether they are same-origin, or same-site, or from completely different sites.
Thanks to this information, you can implement defenses against cross-origin attacks such as cross-site request forgeries (CSRF) and various cross-site leaks.
https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/Fetch_metadata
In 2025, we systematically collected compat data for 28 browser releases:
Firefox 135 - 147
Chrome 133 - 144
Safari 18.4, 26, 26.2
We're keeping your compat tables up-to-date.
We've updated MDN's guide on Subresource Integrity (SRI) and added docs for the HTML `integrity` attribute.
The SRI docs now talk about the fact that you can provide multiple `integrity` values (using the same or different hash functions) and how browsers will handle that.
Thanks to @codingjoe@fosstodon.org for your feedback! We're looking forward to improved SRI support in @django@fosstodon.org!
https://developer.mozilla.org/en-US/docs/Web/Security/Defenses/Subresource_Integrity
We've written a new guide on Federated Identity (FedCM).
The articles helps you to understand what's happening under the surface when a website works with an identity provider (IdP) to add federated sign-in for their users.
We cover the main flows as defined in the OpenID Connect (OIDC) protocol and its security features.
We also present how the FedCM API helps with moving away from third party cookies, and we list some strengths and weaknesses of Federated Identity.
https://developer.mozilla.org/en-US/docs/Web/Security/Authentication/Federated_identity
RE: @floscholz@front-end.social
Catch Daniel and Florian at @FOSSBackstage@floss.social today and tomorrow!
Hey @niklasmerz@w3c.social, thank you so much for your kind donation to Open Web Docs! 💜
It's always a pleasure talking to you about WebViews and figuring out compat data for https://caniwebview.com/
Everyone, join the W3C WebView CG to be part of WebView conversations: https://www.w3.org/groups/cg/webview/
Thanks to 108 of you who responded to the W3C SWAG CG survey on web security features!
77% said they are responsible themselves for implementing web security features and practices. 23% delegate this work to security specialists.
Wondering: Do you delegate risk analysis work, like Threat Modeling, to security specialists, or do you do that yourself, too?
