Browser security
Compatibility & evidence
The feature index / 36 entries

Browser security, indexed.

Look up what a feature does, what it depends on, and what to keep when support falls short. Open an entry for its source records, setup notes and limits.

Find a feature

Search a name, a security goal, or a problem such as clickjacking. Results use current browser versions from the bundled data. Use the planner for older versions.

Showing all 36 features.

Content execution

12 entries

Content Security Policy

1 source record

Restricts the browser resources and execution paths that a document may use.

View 9 browser results
ChromeWorksEdgeWorksFirefoxWorksSafariWorksChrome for AndroidWorksFirefox for AndroidWorksSafari on iOSWorksAndroid WebViewWorksSamsung InternetWorks

CSP nonce sources

Browser data unavailable

Authorises selected inline scripts with unpredictable, response-specific nonce values.

View 9 browser results
ChromeNot enough browser dataEdgeNot enough browser dataFirefoxNot enough browser dataSafariNot enough browser dataChrome for AndroidNot enough browser dataFirefox for AndroidNot enough browser dataSafari on iOSNot enough browser dataAndroid WebViewNot enough browser dataSamsung InternetNot enough browser data

CSP hash sources

Browser data unavailable

Authorises exact inline script or style content through cryptographic source expressions.

View 9 browser results
ChromeNot enough browser dataEdgeNot enough browser dataFirefoxNot enough browser dataSafariNot enough browser dataChrome for AndroidNot enough browser dataFirefox for AndroidNot enough browser dataSafari on iOSNot enough browser dataAndroid WebViewNot enough browser dataSamsung InternetNot enough browser data

CSP strict-dynamic

1 source record

Allows trust from a nonce- or hash-authorised script to propagate to scripts it loads.

View 9 browser results
ChromeWorksEdgeWorksFirefoxWorksSafariWorksChrome for AndroidWorksFirefox for AndroidWorksSafari on iOSWorksAndroid WebViewWorksSamsung InternetWorks

CSP base-uri restriction

1 source record

Restricts which URLs a document may use as its base URL.

View 9 browser results
ChromeWorksEdgeWorksFirefoxWorksSafariWorksChrome for AndroidWorksFirefox for AndroidWorksSafari on iOSWorksAndroid WebViewWorksSamsung InternetWorks

CSP frame-ancestors restriction

1 source record

Restricts which parent documents may embed a page in a frame.

View 9 browser results
ChromeWorksEdgeWorksFirefoxWorksSafariWorksChrome for AndroidWorksFirefox for AndroidWorksSafari on iOSWorksAndroid WebViewWorksSamsung InternetWorks

CSP form-action restriction

1 source record

Restricts the destinations to which a document may submit forms.

View 9 browser results
ChromeWorksEdgeWorksFirefoxWorksSafariWorksChrome for AndroidWorksFirefox for AndroidWorksSafari on iOSWorksAndroid WebViewWorksSamsung InternetWorks

CSP upgrade-insecure-requests

1 source record

Asks the browser to rewrite eligible insecure resource requests to HTTPS.

View 9 browser results
ChromeWorksEdgeWorksFirefoxWorksSafariWorksChrome for AndroidWorksFirefox for AndroidWorksSafari on iOSWorksAndroid WebViewWorksSamsung InternetWorks

CSP sandbox

1 source record

Applies a configurable sandbox to a protected resource.

View 9 browser results
ChromeWorksEdgeWorksFirefoxWorksSafariWorksChrome for AndroidWorksFirefox for AndroidWorksSafari on iOSWorksAndroid WebViewWorksSamsung InternetWorks

Trusted Types enforcement

2 source records

Restricts selected DOM injection sinks to values created through approved policies.

View 9 browser results
ChromeWorksEdgeWorksFirefoxWorksSafariWorksChrome for AndroidWorksFirefox for AndroidWorksSafari on iOSWorksAndroid WebViewWorksSamsung InternetWorks

Subresource Integrity

2 source records

Lets a document require external scripts and stylesheets to match expected digests.

View 9 browser results
ChromeWorksEdgeWorksFirefoxWorksSafariWorksChrome for AndroidWorksFirefox for AndroidWorksSafari on iOSWorksAndroid WebViewWorksSamsung InternetWorks

Subresource Integrity Policy

2 source records

Requires selected script and style requests to carry integrity metadata, with an optional report-only rollout mode.

View 9 browser results
ChromeWorksEdgeWorksFirefoxWorks with limitsSafariWorksChrome for AndroidWorksFirefox for AndroidWorks with limitsSafari on iOSWorksAndroid WebViewWorksSamsung InternetWorks

Cross-origin isolation

6 entries

Cross-Origin-Opener-Policy

1 source record

Controls whether a document shares a browsing context group with cross-origin documents.

View 9 browser results
ChromeWorksEdgeWorksFirefoxWorksSafariWorksChrome for AndroidWorksFirefox for AndroidWorksSafari on iOSWorksAndroid WebViewNot supportedSamsung InternetWorks

Cross-Origin-Embedder-Policy

1 source record

Requires embedded cross-origin resources to opt in through CORS or resource policy.

View 9 browser results
ChromeWorksEdgeWorksFirefoxWorksSafariWorksChrome for AndroidWorksFirefox for AndroidWorksSafari on iOSWorksAndroid WebViewWorksSamsung InternetWorks

Cross-Origin-Resource-Policy

1 source record

Lets a resource state which origins or sites may embed it without CORS.

View 9 browser results
ChromeWorks with limitsEdgeWorksFirefoxWorksSafariWorksChrome for AndroidWorks with limitsFirefox for AndroidWorksSafari on iOSWorksAndroid WebViewWorks with limitsSamsung InternetWorks

Credentialless cross-origin embedding

1 source record

Allows selected cross-origin no-CORS resources to load without credentials under COEP.

View 9 browser results
ChromeWorksEdgeWorksFirefoxWorksSafariNot supportedChrome for AndroidWorksFirefox for AndroidNot supportedSafari on iOSNot supportedAndroid WebViewWorksSamsung InternetWorks

Origin-Agent-Cluster

1 source record

Requests origin-keyed browser agent clustering for a document.

View 9 browser results
ChromeWorksEdgeWorksFirefoxWorksSafariUnknownChrome for AndroidWorksFirefox for AndroidWorksSafari on iOSNot supportedAndroid WebViewWorksSamsung InternetWorks

Fetch Metadata request headers

4 source records

Supplies request context that servers can use in a resource-isolation policy.

View 9 browser results
ChromeWorksEdgeWorksFirefoxWorksSafariNot supportedChrome for AndroidWorksFirefox for AndroidWorksSafari on iOSNot supportedAndroid WebViewWorksSamsung InternetWorks

Browser privacy

9 entries

Permissions Policy

1 source record

Controls whether a document and its embedded frames may use selected browser capabilities.

View 9 browser results
ChromeWorksEdgeWorksFirefoxNot supportedSafariNot supportedChrome for AndroidWorksFirefox for AndroidNot supportedSafari on iOSNot supportedAndroid WebViewWorksSamsung InternetWorks

Referrer Policy

1 source record

Limits referrer information sent with navigations and subresource requests.

View 9 browser results
ChromeWorksEdgeWorksFirefoxWorksSafariWorksChrome for AndroidWorksFirefox for AndroidWorksSafari on iOSWorksAndroid WebViewWorksSamsung InternetWorks

SameSite cookies

1 source record

Restricts when cookies are attached to cross-site requests.

View 9 browser results
ChromeWorksEdgeWorksFirefoxWorksSafariWorks with limitsChrome for AndroidWorksFirefox for AndroidWorksSafari on iOSWorksAndroid WebViewWorksSamsung InternetWorks

Partitioned cookies

1 source record

Stores selected cross-site cookies in a partition keyed by the top-level site.

View 9 browser results
ChromeWorksEdgeWorksFirefoxWorksSafariWorksChrome for AndroidWorksFirefox for AndroidWorksSafari on iOSWorksAndroid WebViewWorksSamsung InternetWorks

HttpOnly cookies

1 source record

Prevents browser scripts from reading a cookie through ordinary cookie APIs.

View 9 browser results
ChromeWorksEdgeWorksFirefoxWorksSafariWorksChrome for AndroidWorksFirefox for AndroidWorksSafari on iOSWorksAndroid WebViewWorksSamsung InternetWorks

Secure cookie prefixes

2 source records

Applies browser-enforced naming constraints to __Secure-, __Host-, __Http-, and __Host-Http- cookies.

View 9 browser results
ChromeWorksEdgeWorksFirefoxWorksSafariNot supportedChrome for AndroidWorksFirefox for AndroidWorksSafari on iOSNot supportedAndroid WebViewWorksSamsung InternetWorks

Permissions Policy: camera

1 source record

Controls whether this document and its frames may use camera.

View 9 browser results
ChromeWorksEdgeWorksFirefoxNot supportedSafariNot supportedChrome for AndroidWorksFirefox for AndroidNot supportedSafari on iOSNot supportedAndroid WebViewWorksSamsung InternetWorks

Permissions Policy: microphone

1 source record

Controls whether this document and its frames may use microphone.

View 9 browser results
ChromeWorksEdgeWorksFirefoxNot supportedSafariNot supportedChrome for AndroidWorksFirefox for AndroidNot supportedSafari on iOSNot supportedAndroid WebViewWorksSamsung InternetWorks

Permissions Policy: geolocation

1 source record

Controls whether this document and its frames may use geolocation.

View 9 browser results
ChromeWorksEdgeWorksFirefoxNot supportedSafariNot supportedChrome for AndroidWorksFirefox for AndroidNot supportedSafari on iOSNot supportedAndroid WebViewWorksSamsung InternetWorks

Transport and response hardening

6 entries

HTTP Strict Transport Security

1 source record

Tells supporting browsers to use HTTPS for a host during a declared period.

View 9 browser results
ChromeWorksEdgeWorksFirefoxWorksSafariWorksChrome for AndroidWorksFirefox for AndroidWorksSafari on iOSWorksAndroid WebViewWorksSamsung InternetWorks

X-Content-Type-Options nosniff

1 source record

Prevents selected responses from being interpreted as a different MIME type.

View 9 browser results
ChromeWorksEdgeWorksFirefoxWorksSafariWorksChrome for AndroidWorksFirefox for AndroidWorksSafari on iOSWorksAndroid WebViewWorksSamsung InternetWorks

Clear-Site-Data

1 source record

Requests removal of selected browser-held data for an origin.

View 9 browser results
ChromeWorksEdgeWorksFirefoxWorksSafariWorksChrome for AndroidWorksFirefox for AndroidWorksSafari on iOSWorksAndroid WebViewWorksSamsung InternetWorks

Clear-Site-Data: cache

1 source record

Requests clearing of browser-held cache in the scope of the response.

View 9 browser results
ChromeWorks with limitsEdgeWorks with limitsFirefoxWorksSafariWorksChrome for AndroidWorks with limitsFirefox for AndroidWorksSafari on iOSWorksAndroid WebViewWorks with limitsSamsung InternetWorks with limits

Clear-Site-Data: cookies

1 source record

Requests clearing of browser-held cookies in the scope of the response.

View 9 browser results
ChromeWorksEdgeWorksFirefoxWorksSafariWorksChrome for AndroidWorksFirefox for AndroidWorksSafari on iOSWorksAndroid WebViewWorksSamsung InternetWorks

Clear-Site-Data: storage

1 source record

Requests clearing of browser-held storage in the scope of the response.

View 9 browser results
ChromeWorksEdgeWorksFirefoxWorksSafariWorksChrome for AndroidWorksFirefox for AndroidWorksSafari on iOSWorksAndroid WebViewWorksSamsung InternetWorks

Authentication

3 entries

WebAuthn platform authenticator detection

1 source record

Detects whether a user-verifying platform authenticator is available.

View 9 browser results
ChromeWorksEdgeWorksFirefoxWorks with limitsSafariWorksChrome for AndroidWorksFirefox for AndroidWorksSafari on iOSWorksAndroid WebViewWorksSamsung InternetWorks

WebAuthn PRF extension

2 source records

Derives scoped pseudorandom outputs from a compatible WebAuthn credential.

View 9 browser results
ChromeWorksEdgeWorksFirefoxWorksSafariNot supportedChrome for AndroidWorksFirefox for AndroidNot supportedSafari on iOSNot supportedAndroid WebViewNot supportedSamsung InternetWorks

WebAuthn conditional mediation

1 source record

Allows passkey suggestions to participate in a credential input flow without an immediate modal prompt.

View 9 browser results
ChromeWorksEdgeWorksFirefoxWorksSafariWorksChrome for AndroidWorksFirefox for AndroidWorksSafari on iOSWorksAndroid WebViewWorks with limitsSamsung InternetWorks