Mutual TLS authenticates a client’s control of a certificate’s private key as well as the server’s identity. It does not inherently identify a physical device. A copied software key can be used elsewhere; hardware binding and device attestation require additional mechanisms. Treat the title’s device identity as an enrollment policy, not something TLS establishes automatically. ...
Any feature that takes a user-supplied URL and fetches it server-side runs that fetch with the server’s identity, network position and credentials. A thumbnailer, a webhook tester, an importer, a PDF renderer — the moment the target comes from the request, the attacker is not visiting your internal network. Your server is visiting it for them. ...
Browsers attach cookies to any request, whatever page caused it. Anti-CSRF tokens and SameSite cookies bind each state change to an intent the user actually saw. Cookies travel without asking Browsers attach cookies to a request based on the target’s domain and path, not on whether the page causing the request was the user’s earlier intent. That means a page on an attacker’s origin can make the victim’s browser send a state-changing request — a transfer, a password change — that carries the authenticated session cookie, and the server sees a request that looks like it came from the legitimate user. This is why a request’s mere presence of credentials is not evidence of the user’s intent; the browser is following the cookie rules, not the user’s choice. ...
A Kubernetes Secret is an API object for confidential values that workloads need. It gives operators a dedicated object type, consumption paths, and access-control targets. It does not make data unreadable to every other actor. Design the boundary around who can retrieve the object, create consumers, inspect their output, and administer the nodes that run them. ...
A reproducible build lets another party recreate specified artifacts byte for byte from the stated source, build instructions, and relevant environment. The promise must name its outputs: matching object files is insufficient when the shipped executable differs. Reproduction provides evidence connecting source and distribution, while source review, provenance, and signatures address other questions. Two identical malicious builds are still malicious, and a compromised toolchain can reproduce its own unwanted behavior. ...
Saving a round trip depends on the protocol and early-data mode. In TLS 1.3, an ordinary full handshake and a resumed handshake without early data normally both take one TLS round trip. Resumption can still reduce certificate transmission and authentication work. The title is not a promise that enabling tickets makes every HTTPS request start one RTT sooner. ...
A CORS preflight asks whether a browser may send a particular cross-origin request. It describes the requesting origin, intended method, and relevant header names. The browser evaluates the reply before sending that request, unless a valid preflight cache entry already grants permission. CORS also governs whether JavaScript can read the actual response. These are related checks, but neither replaces application authentication or authorization. ...
Secure and SameSite are not checks the server performs. They are instructions the user agent follows when it decides whether to attach a cookie to an outgoing request, and the server only sees the result: a Cookie header, or nothing. That asymmetry is the point, and the trap. ...