Collaborate Disseminate
I am getting the error below in trying to renew my certificate from the command line (and thus too from cron). From searching similar error reports, I understand that it means that I initially created a certificate manually and so cannot … Continue reading What does it mean to create a Let’s Encrypt certificate "automatically" rather than manually?
I recall that there is a list of hosting domains that are known to have subdomains from different sources, as for example wix.com and appspot.com, built into browsers. For such domains, subdomains do not inherit trust from the domain.
I fo… Continue reading What is the list of known host domains where subdomains come from different providers?
When I start new torrents, I find there is no traffic for hours. I switch to another network (a cellular data hotspot) and the torrents start flowing. I return to my usual network, and the torrents continue.
I have tried this several tim… Continue reading Can an ISP block BitTorrent peer discovery but not file transfer?
In the browser (e.g., for mysite.com) there is Javascript for third-party services, say somesaas.com. Let’s say that I rewrite the Javascript so that it calls https://proxy.mysite.com instead of https://somesaas.com. Then t… Continue reading How can I forward SaaS calls from the client to the third-party service?
Domain example1.com embeds my iframe.
Domain example2.com embeds an iframe served from example1.com.
I would set X-Frame-Options: ALLOW FROM *.example1.com as well as Content-Security-Policy with frame-ancestors.
But the… Continue reading How do I control multiply-nested embedding of my iframe?
I allow users of my webapp to provide a URL for their own images. They can also provide CSS which may contain URLs to images.
If these URLs are HTTP then the browser does not show the padlock in the URL bar.
What is the best practice for… Continue reading How do I let users point to their own images, yet avoid Mixed Content warnings?
In my rich client, I escape user-provided data before rendering to prevent XSS.
The data comes from the server unescaped. That is necessary for application logic, e.g., avoiding situations where I mistakenly check “O&… Continue reading How do I prevent XSS in direct access to AJAX/JSON APIs?