Page 224 of the DSE Security Knowledge Hub, with source-backed guidance, checklists, explainers, and playbooks.
A user agent establishes or updates dynamic HSTS state only from a valid Strict-Transport-Security field received over error-free secure transport and ignores the field over insecure HTTP.
Read the explainer
A Web link consists of a context IRI, relation type, target IRI, and optional target attributes; serialized link ordering carries no inherent significance. Registered relation names are case-insensitive tokens and cannot constrain context or target representation media types.
Read the guide
A Structured Field serializer accepts a defined List, Dictionary, or Item and returns ASCII; it omits an empty List or Dictionary and fails when the supplied structure cannot be serialized.
Read the playbook
An HTTP/1.1 recipient parses the message as octets, not an unconstrained Unicode stream, before interpreting extracted protocol elements.
Read the briefing
A server supporting PATCH should advertise each accepted patch-document media type in Accept-Patch; the header’s presence also indicates that PATCH is allowed for that resource.
Read the checklist
Before parsing a URI reference that might be relative, a parser must establish an absolute base URI; a reference used as that base is first made absolute and stripped of its fragment.
Read the explainer
A Problem Details consumer MUST use the resolved type URI as the primary problem-type identifier; when type is absent, its value is assumed to be about:blank. The status member is advisory, but a generator that includes it MUST give it the same status code as the actual HTTP response.
Read the guide
A cache MUST NOT store a response unless Section 3's method, final-status, cache-control, shared-cache, authorization, and explicit or heuristic cacheability prerequisites all permit storage.
Read the playbook
A user agent sends a cookie only when a host-only cookie exactly matches the request host or a domain cookie domain-matches it, and the request path path-matches the cookie path.
Read the briefing
Each QUIC endpoint selects connection IDs that route packets back to itself and identify the connection despite lower-layer address changes; externally correlatable information MUST NOT be encoded in those IDs.
Read the checklist