https://nalar.dev/tags/http-security/ Recent content in HTTP Security on Nalar Hugo en-us Sat, 12 Sep 2026 00:00:00 +0700 https://nalar.dev/control-referrer-data-with-referrer-policy/ Sat, 12 Sep 2026 00:00:00 +0700 https://nalar.dev/control-referrer-data-with-referrer-policy/ <p>A browser can attach source-page information to an outbound request through the HTTP <code>Referer</code> header. That context can help with analytics, navigation flows, and abuse detection, but it can also expose more URL data than a destination needs.</p> <p>An explicit <code>Referrer-Policy</code> gives a site control over this boundary. The main security objective is simple: <strong>send the minimum source context needed for legitimate behavior, especially when a request crosses to another origin</strong>.</p> https://nalar.dev/reject-ambiguous-http-message-framing/ Sat, 12 Sep 2026 00:00:00 +0700 https://nalar.dev/reject-ambiguous-http-message-framing/ <p>Modern web requests often cross several HTTP-speaking components before reaching application code. A request may pass through a CDN, load balancer, reverse proxy, API gateway, service mesh, and application server. Each component must agree on exactly where one request ends and the next begins.</p> <p>If two components interpret message boundaries differently, bytes that one component treats as part of a request can become a second request for another component. This parser disagreement is the foundation of HTTP request smuggling.</p>