ControlCurrentbrowser security planning
What each feature does

Explore browser security features

Each page explains what the feature helps protect, which browsers support it, what you need before using it, what it cannot guarantee, and what fallback to keep in place.

Find the right feature

Search and filter 30 features

Search by a feature name, security goal, or the problem it helps address. Filtering happens on this device and does not make a network request.

Showing all 30 features.

Content execution1 browser data record

Content Security Policy

Restricts the browser resources and execution paths that a document may use.

ChromeWorksEdgeWorksFirefoxWorksSafariWorksChrome for AndroidWorksFirefox for AndroidWorksSafari on iOSWorksAndroid WebViewWorksSamsung InternetWorks
Content executionBrowser data unavailable

CSP nonce sources

Authorises selected inline scripts with unpredictable, response-specific nonce values.

ChromeNot enough browser dataEdgeNot enough browser dataFirefoxNot enough browser dataSafariNot enough browser dataChrome for AndroidNot enough browser dataFirefox for AndroidNot enough browser dataSafari on iOSNot enough browser dataAndroid WebViewNot enough browser dataSamsung InternetNot enough browser data
Content executionBrowser data unavailable

CSP hash sources

Authorises exact inline script or style content through cryptographic source expressions.

ChromeNot enough browser dataEdgeNot enough browser dataFirefoxNot enough browser dataSafariNot enough browser dataChrome for AndroidNot enough browser dataFirefox for AndroidNot enough browser dataSafari on iOSNot enough browser dataAndroid WebViewNot enough browser dataSamsung InternetNot enough browser data
Content execution1 browser data record

CSP strict-dynamic

Allows trust from a nonce- or hash-authorised script to propagate to scripts it loads.

ChromeWorksEdgeWorksFirefoxWorksSafariWorksChrome for AndroidWorksFirefox for AndroidWorksSafari on iOSWorksAndroid WebViewWorksSamsung InternetWorks
Content execution1 browser data record

CSP base-uri restriction

Restricts which URLs a document may use as its base URL.

ChromeWorksEdgeWorksFirefoxWorksSafariWorksChrome for AndroidWorksFirefox for AndroidWorksSafari on iOSWorksAndroid WebViewWorksSamsung InternetWorks
Content execution1 browser data record

CSP frame-ancestors restriction

Restricts which parent documents may embed a page in a frame.

ChromeWorksEdgeWorksFirefoxWorksSafariWorksChrome for AndroidWorksFirefox for AndroidWorksSafari on iOSWorksAndroid WebViewWorksSamsung InternetWorks
Content execution1 browser data record

CSP form-action restriction

Restricts the destinations to which a document may submit forms.

ChromeWorksEdgeWorksFirefoxWorksSafariWorksChrome for AndroidWorksFirefox for AndroidWorksSafari on iOSWorksAndroid WebViewWorksSamsung InternetWorks
Content execution1 browser data record

CSP upgrade-insecure-requests

Asks the browser to rewrite eligible insecure resource requests to HTTPS.

ChromeWorksEdgeWorksFirefoxWorksSafariWorksChrome for AndroidWorksFirefox for AndroidWorksSafari on iOSWorksAndroid WebViewWorksSamsung InternetWorks
Content execution1 browser data record

CSP sandbox

Applies a configurable sandbox to a protected resource.

ChromeWorksEdgeWorksFirefoxWorksSafariWorksChrome for AndroidWorksFirefox for AndroidWorksSafari on iOSWorksAndroid WebViewWorksSamsung InternetWorks
Content execution2 browser data records

Trusted Types enforcement

Restricts selected DOM injection sinks to values created through approved policies.

ChromeWorksEdgeWorksFirefoxWorksSafariWorksChrome for AndroidWorksFirefox for AndroidWorksSafari on iOSWorksAndroid WebViewWorksSamsung InternetWorks
Content execution2 browser data records

Subresource Integrity

Lets a document require external scripts and stylesheets to match expected digests.

ChromeWorksEdgeWorksFirefoxWorksSafariWorksChrome for AndroidWorksFirefox for AndroidWorksSafari on iOSWorksAndroid WebViewWorksSamsung InternetWorks
Content execution2 browser data records

Subresource Integrity Policy

Requires selected script and style requests to carry integrity metadata, with an optional report-only rollout mode.

ChromeWorksEdgeWorksFirefoxWorks with limitsSafariWorksChrome for AndroidWorksFirefox for AndroidWorks with limitsSafari on iOSWorksAndroid WebViewWorksSamsung InternetNot supported
Cross-origin isolation1 browser data record

Cross-Origin-Opener-Policy

Controls whether a document shares a browsing context group with cross-origin documents.

ChromeWorksEdgeWorksFirefoxWorksSafariWorksChrome for AndroidWorksFirefox for AndroidWorksSafari on iOSWorksAndroid WebViewNot supportedSamsung InternetWorks
Cross-origin isolation1 browser data record

Cross-Origin-Embedder-Policy

Requires embedded cross-origin resources to opt in through CORS or resource policy.

ChromeWorksEdgeWorksFirefoxWorksSafariWorksChrome for AndroidWorksFirefox for AndroidWorksSafari on iOSWorksAndroid WebViewWorksSamsung InternetWorks
Cross-origin isolation1 browser data record

Cross-Origin-Resource-Policy

Lets a resource state which origins or sites may embed it without CORS.

ChromeWorks with limitsEdgeWorksFirefoxWorksSafariWorksChrome for AndroidWorks with limitsFirefox for AndroidWorksSafari on iOSWorksAndroid WebViewWorks with limitsSamsung InternetWorks
Cross-origin isolation1 browser data record

Credentialless cross-origin embedding

Allows selected cross-origin no-CORS resources to load without credentials under COEP.

ChromeWorksEdgeWorksFirefoxWorksSafariNot supportedChrome for AndroidWorksFirefox for AndroidNot supportedSafari on iOSNot supportedAndroid WebViewWorksSamsung InternetWorks
Cross-origin isolation1 browser data record

Origin-Agent-Cluster

Requests origin-keyed browser agent clustering for a document.

ChromeWorksEdgeWorksFirefoxWorksSafariUnknownChrome for AndroidWorksFirefox for AndroidWorksSafari on iOSNot supportedAndroid WebViewWorksSamsung InternetWorks
Cross-origin isolation4 browser data records

Fetch Metadata request headers

Supplies request context that servers can use in a resource-isolation policy.

ChromeWorksEdgeWorksFirefoxWorksSafariNot supportedChrome for AndroidWorksFirefox for AndroidWorksSafari on iOSNot supportedAndroid WebViewWorksSamsung InternetWorks
Browser privacy1 browser data record

Permissions Policy

Controls whether a document and its embedded frames may use selected browser capabilities.

ChromeWorksEdgeWorksFirefoxNot supportedSafariNot supportedChrome for AndroidWorksFirefox for AndroidNot supportedSafari on iOSNot supportedAndroid WebViewWorksSamsung InternetWorks
Transport and response hardening1 browser data record

HTTP Strict Transport Security

Tells supporting browsers to use HTTPS for a host during a declared period.

ChromeWorksEdgeWorksFirefoxWorksSafariWorksChrome for AndroidWorksFirefox for AndroidWorksSafari on iOSWorksAndroid WebViewWorksSamsung InternetWorks
Transport and response hardening1 browser data record

X-Content-Type-Options nosniff

Prevents selected responses from being interpreted as a different MIME type.

ChromeWorksEdgeWorksFirefoxWorksSafariWorksChrome for AndroidWorksFirefox for AndroidWorksSafari on iOSWorksAndroid WebViewWorksSamsung InternetWorks
Transport and response hardening1 browser data record

Clear-Site-Data

Requests removal of selected browser-held data for an origin.

ChromeWorksEdgeWorksFirefoxWorksSafariWorksChrome for AndroidWorksFirefox for AndroidWorksSafari on iOSWorksAndroid WebViewWorksSamsung InternetWorks
Browser privacy1 browser data record

Referrer Policy

Limits referrer information sent with navigations and subresource requests.

ChromeWorksEdgeWorksFirefoxWorksSafariWorksChrome for AndroidWorksFirefox for AndroidWorksSafari on iOSWorksAndroid WebViewWorksSamsung InternetWorks
Browser privacy1 browser data record

SameSite cookies

Restricts when cookies are attached to cross-site requests.

ChromeWorksEdgeWorksFirefoxWorksSafariWorks with limitsChrome for AndroidWorksFirefox for AndroidWorksSafari on iOSWorksAndroid WebViewWorksSamsung InternetWorks
Browser privacy1 browser data record

Partitioned cookies

Stores selected cross-site cookies in a partition keyed by the top-level site.

ChromeWorksEdgeWorksFirefoxWorksSafariWorksChrome for AndroidWorksFirefox for AndroidWorksSafari on iOSWorksAndroid WebViewWorksSamsung InternetWorks
Browser privacy1 browser data record

HttpOnly cookies

Prevents browser scripts from reading a cookie through ordinary cookie APIs.

ChromeWorksEdgeWorksFirefoxWorksSafariWorksChrome for AndroidWorksFirefox for AndroidWorksSafari on iOSWorksAndroid WebViewWorksSamsung InternetWorks
Browser privacy2 browser data records

Secure cookie prefixes

Applies browser-enforced naming constraints to __Secure-, __Host-, __Http-, and __Host-Http- cookies.

ChromeWorksEdgeWorksFirefoxWorksSafariNot supportedChrome for AndroidWorksFirefox for AndroidWorksSafari on iOSNot supportedAndroid WebViewWorksSamsung InternetNot supported
Authentication1 browser data record

WebAuthn platform authenticator detection

Detects whether a user-verifying platform authenticator is available.

ChromeWorksEdgeWorksFirefoxWorks with limitsSafariWorksChrome for AndroidWorksFirefox for AndroidWorksSafari on iOSWorksAndroid WebViewNot supportedSamsung InternetWorks
Authentication2 browser data records

WebAuthn PRF extension

Derives scoped pseudorandom outputs from a compatible WebAuthn credential.

ChromeWorksEdgeWorksFirefoxWorksSafariNot supportedChrome for AndroidWorksFirefox for AndroidNot supportedSafari on iOSNot supportedAndroid WebViewNot supportedSamsung InternetWorks
Authentication1 browser data record

WebAuthn conditional mediation

Allows passkey suggestions to participate in a credential input flow without an immediate modal prompt.

ChromeWorksEdgeWorksFirefoxWorksSafariWorksChrome for AndroidWorksFirefox for AndroidWorksSafari on iOSWorksAndroid WebViewNot supportedSamsung InternetWorks