In an effort to improve security on the client-side modern browsers have introduced a means to allow for web applications request a client to remove persisted data. Of course, not supported in any version of MSIE or Safari, but all modern browsers Chrome 61+, Edge 79+, Firefox 63+ support.
This approach can be useful at logoff or session invalidation to remove data from the client-side, particularly in cases of persistent or reflected XSS.
Clear-Site-Data: “cache”, “cookies”, “storage”, “executionContexts”
ECMAScript 6 (ES2015) added the ‘let’ keyword. let works a lot like the legacy ‘var’ keyword, but adds scoping capabilities.
Unfortunately, support cannot be retrofitted to older browsers with a polyfill, supported by IE11(with limitations), Edge 12+, Firefox 44+, Chrome 49+, Safari 10+. If you still need to support older browsers or devices you may want to stick with var.
Formally introduced in ES6,
Unfortunately, support cannot be retrofitted to older browsers with a polyfill, supported by IE11+, Edge 12+, Firefox 36+, Chrome 21+, Safari 5.1+. If you still need to support older browsers or devices you may want to stick with
NOTE: some initial implementations may have thrown different exceptions on reassignment, were not limited in scope, or treated
const like ‘
Name may start with letter, underscore or $ character.
The download attribute allows for the downloaded filename to be specified to be something different than the name in the url.
This is available only on the
A tag when an
href attribute is already specified and works similarly to setting the header as:
Content-Disposition: attachment; filename="filename.pdf"
NOTE: this is not currently available in IE, Edge(prior to 13) or IOS Safari.
I recently crossed paths with a customer that was still using Windows XP and experiencing problems with a website. This led me to evaluate their options for continuing to use this once very common, but now unsupported operating system.
After 12 years, support for Windows XP ended April 8, 2014. Microsoft will no longer provide security updates or technical support.
The most recent version of Internet Explorer in Windows XP was IE 8.0.6001.18702
Even Apple, Google and Mozilla Firefox have ceased to maintain browsers for this operating system, dropping support for Windows XP and Vista at the same time.
Firefox 52.9.0 ESR
An additional problem with use of IE8 on Windows XP is that it only supports up to TLS1.0 which is currently being replaced by TLS1.2 in many web applications.
A relatively new HTTP Header that is supported by most modern browsers (except MSIE) is the “Referrer-Policy” header. There have been previous attempts to implement similar protections through use of the ‘rel’ (or ‘rev’) attributes on links to external websites. The latest approach takes a different approach and prevents leaking of internal URLs, and in some cases parameters, to external websites. This is important from a security perspective as you might maintain some sensitive information in your page urls, that would otherwise be inadvertently shared with an external website.
Clearly, you’ll need to determine your own level of security based upon your needs. Example: ‘no-referrer’ would be the most strict and would prevent the browser from sending the ‘Referer'(sic) header even to your own websites pages.
Example header values:
Implementation can be accomplished in many ways, the most simple being and addition to your HTTP server configuration similar to the one shown below for Apache 2.x:
Header always set Referrer-Policy strict-origin
As the web has been shifting to HTTPS for security and performance reasons, there are many methods to migrate users. One simple method is via the use of the Content-Security Header.
Most modern browsers, except MSIE, currently support this approach.
– Chrome 43+
SortSite is a popular desktop software for testing of web applications for broken links, browser compatibility, accessibility and common spelling errors. It is also available as a web application known as “OnDemand“.
You can generate a free sample test of your website at:
<script defer="defer" src="example.js"></script>
NOTE: Do not use defer for external scripts that might depend on each other if you need to support MSIE9 and earlier.