BestHub
Sign in
Tagged articles

CSP

29 articles · Page 1 of 1
Ops Development & AI Practice
Ops Development & AI Practice
Sep 18, 2026 · Information Security

Full-Stack Production Security: P1-P4 Priority Defense-in-Depth Implementation Guide

This article presents a comprehensive defense-in-depth matrix for production security across infrastructure, backend, and frontend layers, prioritizing controls from P1 (must-have survival basics like zero trust, MFA, secrets management) to P4 (edge-case hardening), with a three-phase rollout roadmap and anti-pattern warnings.

CSPOWASP Top 10P1-P4 priority
0 likes · 35 min read
Full-Stack Production Security: P1-P4 Priority Defense-in-Depth Implementation Guide
Java Tech Enthusiast
Java Tech Enthusiast
Aug 28, 2026 · Information Security

Embedding a Whole Website Inside a Favicon: What the Risks Reveal

By encoding a tiny HTML page into an 8×8 pixel favicon, the author demonstrates that a website can be hidden in a seemingly innocuous image, explores the steganographic technique, evaluates its storage limits, and discusses the security implications and practical drawbacks of such a covert channel.

CSPWeb Securitybrowser
0 likes · 14 min read
Embedding a Whole Website Inside a Favicon: What the Risks Reveal
IT Services Circle
IT Services Circle
Aug 8, 2026 · Information Security

Embedding an Entire Website Inside a Favicon: What the Experiment Reveals

The author demonstrates that a favicon—an 8×8‑pixel PNG image—can store a complete 166‑byte HTML page by encoding each byte into the RGB channels of individual pixels, then analyzes how this steganographic technique can bypass file‑type checks, evade CSP img‑src restrictions, and serve as a covert data channel, while noting its limited practical value for legitimate web publishing.

CSPHTML injectionWeb Security
0 likes · 14 min read
Embedding an Entire Website Inside a Favicon: What the Experiment Reveals
Random Bulletin
Random Bulletin
Jul 23, 2026 · Backend Development

From Threads to Coroutines: Scaling to Millions of QPS

The article explains why the traditional one‑request‑one‑thread model collapses at tens of thousands of connections due to memory, scheduling and cache costs, and shows how user‑space coroutine scheduling, stack‑less designs, Go's GMP model, Java virtual threads and CSP channels enable millions of concurrent connections with synchronous‑style code while highlighting trade‑offs and pitfalls.

CSPCoroutinesGo
0 likes · 21 min read
From Threads to Coroutines: Scaling to Millions of QPS
Raymond Ops
Raymond Ops
Feb 2, 2026 · Information Security

Boost Your Web Security: Essential HTTP Header Configurations You’re Missing

This guide shows operations engineers how to dramatically improve web application protection by configuring often‑overlooked HTTP security headers—CSP, X‑Frame‑Options, HSTS, Referrer‑Policy, Permissions‑Policy, and more—through practical Nginx/Apache/Node.js examples, verification scripts, and automation tips.

CSPDevOpsHTTP security
0 likes · 19 min read
Boost Your Web Security: Essential HTTP Header Configurations You’re Missing
Architect's Must-Have
Architect's Must-Have
Sep 15, 2025 · Operations

Resolving Common Jenkins Compatibility Issues and Optimizing Performance

This guide details how to address Jenkins Performance plugin compatibility problems, modify CSP security policies, customize the Jenkins context path, fix git clone timeouts, resolve batch command failures, replace vulnerable JARs, run JNLP files on Windows agents, disable CSRF protection, adjust JVM memory settings, and implement disk space and build timeout optimizations.

CI/CDCSPDevOps
0 likes · 12 min read
Resolving Common Jenkins Compatibility Issues and Optimizing Performance
Ops Development & AI Practice
Ops Development & AI Practice
Sep 2, 2025 · Information Security

How XSS Bypasses Browser Sandboxes and What You Can Do About It

Even though modern browsers enforce sandboxing and many frameworks add XSS defenses, a successful cross‑site scripting attack can still break through server and browser protections, allowing attackers to hijack sessions, steal data, scan internal networks, exploit browser bugs, or run cryptojacking scripts.

CSPCryptojackingSame-Origin Policy
0 likes · 9 min read
How XSS Bypasses Browser Sandboxes and What You Can Do About It
Tencent Technical Engineering
Tencent Technical Engineering
Apr 10, 2025 · Information Security

AI-Generated Code Introduces XSS Vulnerabilities: A Case Study and Security Guidance

The Woodpecker team shows that AI‑generated code, exemplified by Simon Willison’s HTML slideshow tool, can embed unsanitized inputs that create exploitable XSS flaws, and they recommend zero‑trust AI prompts, rigorous input filtering, CSP, AI‑assisted scanning, and secure supply‑chain practices to mitigate such risks.

AI securityCSPSimon Willison
0 likes · 9 min read
AI-Generated Code Introduces XSS Vulnerabilities: A Case Study and Security Guidance
Liangxu Linux
Liangxu Linux
Feb 19, 2025 · Information Security

How to Harden Nginx: Essential Security Configurations and Best Practices

This comprehensive guide walks system administrators and developers through essential Nginx hardening steps—including hiding version info, restricting sensitive directories, custom error pages, CSP, HTTPS, SSL tuning, file permissions, security headers, rate limiting, IP whitelisting, and logging—to dramatically improve web server security.

CSPNginxSSL
0 likes · 31 min read
How to Harden Nginx: Essential Security Configurations and Best Practices
MaGe Linux Operations
MaGe Linux Operations
Feb 14, 2025 · Information Security

How to Harden Nginx: Essential Security Practices for Safer Web Servers

This guide provides a comprehensive, step‑by‑step hardening roadmap for Nginx, covering version hiding, directory protection, HTTPS enablement, custom error pages, CSP, file permissions, security headers, connection limits, IP whitelisting, SSL optimization, secure file uploads, common attack mitigations, logging best practices, and additional hardening measures to protect web services from a wide range of threats.

Access ControlCSPHTTPS
0 likes · 31 min read
How to Harden Nginx: Essential Security Practices for Safer Web Servers
Alibaba Terminal Technology
Alibaba Terminal Technology
Sep 22, 2022 · Frontend Development

Why “Script Error.” Happens and How to Fix It in Modern Browsers

This article explains the origins of the generic “Script Error.” message, why browsers hide details due to same‑origin policy, and offers practical solutions such as using the crossorigin attribute, CSP reporting, and systematic approaches adopted by major companies to handle script errors effectively.

CSPJavaScriptcrossorigin
0 likes · 10 min read
Why “Script Error.” Happens and How to Fix It in Modern Browsers
DaTaobao Tech
DaTaobao Tech
Aug 25, 2022 · Frontend Development

Understanding and Handling Script Error in Web Development

The article explains that browsers mask cross‑origin script failures as generic “Script error” due to the same‑origin policy, outlines the proper fix of adding the crossorigin attribute and Access‑Control‑Allow‑Origin header, critiques ad‑hoc proxy or try‑catch workarounds, and recommends systematic measures such as CSP Report‑Only, monitoring tools, and proper script whitelisting.

CSPCross-OriginFront-end debugging
0 likes · 7 min read
Understanding and Handling Script Error in Web Development
NetEase Cloud Music Tech Team
NetEase Cloud Music Tech Team
May 5, 2022 · Frontend Development

Building a Music Recognition Chrome Extension with Manifest V3 and WebAssembly

The article explains how NetEase Cloud Music built a Chrome extension that captures tab audio, processes it with an AudioWorkletNode, extracts fingerprints via WebAssembly in a sandboxed iframe, and matches songs locally, all while navigating Manifest V3’s service‑worker, CSP, and deprecation constraints.

Audio FingerprintingAudioWorkletBrowser plugin
0 likes · 12 min read
Building a Music Recognition Chrome Extension with Manifest V3 and WebAssembly
MaGe Linux Operations
MaGe Linux Operations
Apr 12, 2022 · Backend Development

Understanding Go’s CSP Model: Goroutine, Channel, Scheduler

This article explains Go’s concurrency fundamentals, distinguishing concurrency from parallelism, describing the CSP model built on goroutines and channels, and detailing the underlying M‑P‑G scheduler architecture—including thread models, runqueues, and load balancing—providing a comprehensive overview for developers.

CSPConcurrencyGo
0 likes · 11 min read
Understanding Go’s CSP Model: Goroutine, Channel, Scheduler
Qunar Tech Salon
Qunar Tech Salon
Oct 18, 2018 · Information Security

XSS Attacks: Introduction, Classification, Prevention, and Detection

This article explains the fundamentals of Cross‑Site Scripting (XSS) attacks, presents real‑world examples, classifies stored, reflected, and DOM‑based XSS, and provides comprehensive prevention, detection, and mitigation techniques for frontend developers, including proper escaping, whitelist schemes, CSP, and secure coding practices.

CSPInput ValidationWeb Security
0 likes · 27 min read
XSS Attacks: Introduction, Classification, Prevention, and Detection
Architects' Tech Alliance
Architects' Tech Alliance
Oct 3, 2017 · Fundamentals

Understanding SDN and NFV: Concepts, Solutions, and Challenges for CSPs

The article provides a comprehensive overview of Software‑Defined Networking (SDN) and Network Functions Virtualization (NFV), detailing their concepts, major vendor solutions, open‑source projects, industry challenges, and the considerations CSPs must address when adopting these technologies for agile, automated network services.

CSPNFVNetwork Virtualization
0 likes · 11 min read
Understanding SDN and NFV: Concepts, Solutions, and Challenges for CSPs
Architect
Architect
Dec 16, 2015 · Information Security

Understanding HTTPS Certificates, Trust Chains, and Security Practices

This article explains how HTTPS certificates are trusted, the role of Certificate Authorities, how browsers verify signatures, common pitfalls such as compromised root certificates, and practical measures like CSP and gradual rollout strategies to ensure secure web deployments across different regions and devices.

CSPHTTPSTLS
0 likes · 8 min read
Understanding HTTPS Certificates, Trust Chains, and Security Practices
High Availability Architecture
High Availability Architecture
Jul 30, 2015 · Information Security

Web Application Security Threats and Mitigation Strategies

This article outlines the most common web application security threats—including XSS, SQL injection, CSRF, transmission hijacking, credential leaks, brute‑force attacks, and token theft—and provides practical mitigation techniques such as proper escaping, CSP, parameterized queries, CSRF tokens, HTTPS, HSTS, HPKP, encrypted password storage, two‑factor authentication, and robust token handling.

CSPCSRFHTTPS
0 likes · 26 min read
Web Application Security Threats and Mitigation Strategies