Jekyll2026-05-24T01:11:00+00:00https://rixx.github.io/baseline-updates/feed/by_tag/security.xmlUpdates to the Baseline collection. Including RSS feeds (both for all updates and individual tags).2026-05-21T00:00:00+00:002026-05-21T00:00:00+00:00https://rixx.github.io/baseline-updates/2026/05/21/user-activationcaniuse · mdn · spec

The navigator.userActivation API reveals whether the user has interacted with the page through an “activation” gesture such as a click, tap, or key press. User activation gated APIs (such as the fullscreen API) fail without user interaction, and this API allows you to predict such a failure.

Source features

• api.Navigator.userActivation [mdn]
• api.UserActivation [mdn]
• api.UserActivation.hasBeenActive [mdn]
• api.UserActivation.isActive [mdn]

]]>

2026-02-24T00:00:00+00:002026-02-24T00:00:00+00:00https://rixx.github.io/baseline-updates/2026/02/24/trusted-typescaniuse · mdn · spec

Trusted types allow you to lock down insecure parts of the DOM API and prevent client-side cross-site scripting (XSS) attacks.

Source features

• api.Element.innerHTML.enforces_trusted_types [mdn]
• api.HTMLScriptElement.innerText.enforces_trusted_types [mdn]
• api.HTMLScriptElement.src.enforces_trusted_types [mdn]
• api.HTMLScriptElement.text.enforces_trusted_types [mdn]
• api.HTMLScriptElement.textContent.enforces_trusted_types [mdn]
• api.ShadowRoot.innerHTML.enforces_trusted_types [mdn]
• api.TrustedHTML [mdn]
• api.TrustedHTML.toString [mdn]
• api.TrustedScript [mdn]
• api.TrustedScript.toString [mdn]
• api.TrustedScriptURL [mdn]
• api.TrustedScriptURL.toString [mdn]
• api.TrustedTypePolicy [mdn]
• api.TrustedTypePolicy.createHTML [mdn]
• api.TrustedTypePolicy.createScript [mdn]
• api.TrustedTypePolicy.createScriptURL [mdn]
• api.TrustedTypePolicy.name [mdn]
• api.TrustedTypePolicyFactory [mdn]
• api.TrustedTypePolicyFactory.createPolicy [mdn]
• api.TrustedTypePolicyFactory.defaultPolicy [mdn]
• api.TrustedTypePolicyFactory.emptyHTML [mdn]
• api.TrustedTypePolicyFactory.emptyScript [mdn]
• api.TrustedTypePolicyFactory.getAttributeType [mdn]
• api.TrustedTypePolicyFactory.getPropertyType [mdn]
• api.TrustedTypePolicyFactory.isHTML [mdn]
• api.TrustedTypePolicyFactory.isScript [mdn]
• api.TrustedTypePolicyFactory.isScriptURL [mdn]
• api.setInterval.code_param_enforces_trusted_types [mdn]
• api.setTimeout.code_param_enforces_trusted_types [mdn]
• api.trustedTypes [mdn]
• http.headers.Content-Security-Policy.require-trusted-types-for [mdn]
• http.headers.Content-Security-Policy.trusted-types [mdn]
• api.TrustedHTML.toJSON [mdn]
• api.TrustedScript.toJSON [mdn]
• api.TrustedScriptURL.toJSON [mdn]

]]>

2025-03-12T00:00:00+00:002025-03-12T00:00:00+00:00https://rixx.github.io/baseline-updates/2025/03/12/permissionscaniuse · mdn · [spec]([‘https://w3c.github.io/permissions/’, ‘https://wicg.github.io/permissions-request/#dom-permissions-request’])

The navigator.permissions API checks whether a permission, such as access to geolocation data, has been granted.

Source features

• api.Navigator.permissions [mdn]
• api.PermissionStatus [mdn]
• api.Permissions [mdn]
• api.Permissions.query [mdn]
• api.PermissionStatus.state [mdn]
• api.PermissionStatus.name [mdn]
• api.PermissionStatus.change_event [mdn]
• api.WorkerNavigator.permissions [mdn]
• api.Permissions.request [mdn]

]]>

2022-07-15T00:00:00+00:002022-07-15T00:00:00+00:00https://rixx.github.io/baseline-updates/2022/07/15/mixed-contentcaniuse · mdn · spec

When a document is loaded over HTTPS, browsers ensure that none of the document’s resources are loaded over an insecure protocol. Instead, resources that the document attempts to load over an insecure protocol are either loaded over HTTPS or are blocked.

Source features

• http.mixed-content [mdn]
• http.mixed-content.blockable_mixed_content [mdn]
• http.mixed-content.auto_upgrade_video_audio [mdn]
• http.mixed-content.auto_upgrade_images [mdn]
• http.mixed-content.block_mixed_downloads [mdn]
• http.mixed-content.allow_loopback_url [mdn]
• http.mixed-content.allow_localhost_url [mdn]
• http.mixed-content.allow_file_urls [mdn]

]]>

2020-10-30T00:00:00+00:002020-10-30T00:00:00+00:00https://rixx.github.io/baseline-updates/2020/10/30/upgrade-insecure-requestscaniuse · mdn · spec

The Upgrade-Insecure-Requests HTTP request header tells the server that the response should redirect to a secure (HTTPS) resource.

Source features

• http.headers.Content-Security-Policy.upgrade-insecure-requests [mdn]
• http.headers.Upgrade-Insecure-Requests [mdn]

]]>

2020-01-15T00:00:00+00:002020-01-15T00:00:00+00:00https://rixx.github.io/baseline-updates/2020/01/15/mixed-contentcaniuse · mdn · spec

When a document is loaded over HTTPS, browsers ensure that none of the document’s resources are loaded over an insecure protocol. Instead, resources that the document attempts to load over an insecure protocol are either loaded over HTTPS or are blocked.

Source features

• http.mixed-content [mdn]
• http.mixed-content.blockable_mixed_content [mdn]
• http.mixed-content.auto_upgrade_video_audio [mdn]
• http.mixed-content.auto_upgrade_images [mdn]
• http.mixed-content.block_mixed_downloads [mdn]
• http.mixed-content.allow_loopback_url [mdn]
• http.mixed-content.allow_localhost_url [mdn]
• http.mixed-content.allow_file_urls [mdn]

]]>

2019-02-02T00:00:00+00:002019-02-02T00:00:00+00:00https://rixx.github.io/baseline-updates/2019/02/02/cspcaniuse · mdn · spec

Content Security Policy (CSP) helps to mitigate certain security threats, including cross-site scripting (XSS) and clickjacking attacks. It consists of a set of directives from a website to a browser, which instruct the browser to restrict the things that the site is allowed to do.

Source features

• http.headers.Content-Security-Policy [mdn]
• http.headers.Content-Security-Policy-Report-Only [mdn]
• http.headers.Content-Security-Policy.default-src [mdn]
• http.headers.Content-Security-Policy.font-src [mdn]
• http.headers.Content-Security-Policy.frame-src [mdn]
• http.headers.Content-Security-Policy.img-src [mdn]
• http.headers.Content-Security-Policy.media-src [mdn]
• http.headers.Content-Security-Policy.object-src [mdn]
• http.headers.Content-Security-Policy.script-src [mdn]
• http.headers.Content-Security-Policy.style-src [mdn]
• http.headers.Content-Security-Policy.connect-src [mdn]
• http.headers.Content-Security-Policy.sandbox [mdn]
• http.headers.Content-Security-Policy.form-action [mdn]
• http.headers.Content-Security-Policy.child-src [mdn]
• html.elements.meta.http-equiv.content-security-policy [mdn]
• http.headers.Content-Security-Policy.frame-ancestors [mdn]
• http.headers.Content-Security-Policy.upgrade-insecure-requests [mdn]
• http.headers.Content-Security-Policy.meta-element-support [mdn]
• api.Element.securitypolicyviolation_event [mdn]
• api.SecurityPolicyViolationEvent [mdn]
• api.SecurityPolicyViolationEvent.SecurityPolicyViolationEvent [mdn]
• api.SecurityPolicyViolationEvent.blockedURI [mdn]
• api.SecurityPolicyViolationEvent.columnNumber [mdn]
• api.SecurityPolicyViolationEvent.documentURI [mdn]
• api.SecurityPolicyViolationEvent.effectiveDirective [mdn]
• api.SecurityPolicyViolationEvent.lineNumber [mdn]
• api.SecurityPolicyViolationEvent.originalPolicy [mdn]
• api.SecurityPolicyViolationEvent.referrer [mdn]
• api.SecurityPolicyViolationEvent.sourceFile [mdn]
• api.SecurityPolicyViolationEvent.statusCode [mdn]
• api.SecurityPolicyViolationEvent.violatedDirective [mdn]
• api.WorkerGlobalScope.securitypolicyviolation_event [mdn]
• http.headers.Content-Security-Policy.base-uri [mdn]
• http.headers.Content-Security-Policy.manifest-src [mdn]
• http.headers.Content-Security-Policy.worker_support [mdn]
• api.SecurityPolicyViolationEvent.disposition [mdn]
• api.SecurityPolicyViolationEvent.sample [mdn]
• http.headers.Content-Security-Policy.report-sample [mdn]
• api.Document.securitypolicyviolation_event [mdn]
• http.headers.Content-Security-Policy.worker-src [mdn]
• http.headers.Content-Security-Policy.script-src.wasm-unsafe-eval [mdn]
• http.headers.Content-Security-Policy.script-src-attr [mdn]
• http.headers.Content-Security-Policy.script-src-elem [mdn]
• http.headers.Content-Security-Policy.style-src-attr [mdn]
• http.headers.Content-Security-Policy.style-src-elem [mdn]
• http.headers.Content-Security-Policy.unsafe-hashes [mdn]
• http.headers.Content-Security-Policy.script-src.external_scripts [mdn]
• http.headers.Content-Security-Policy.strict-dynamic [mdn]
• api.SecurityPolicyViolationEvent.worker_support [mdn]
• http.headers.Content-Security-Policy.report-to [mdn]
• api.HTMLIFrameElement.csp [mdn]
• html.elements.iframe.csp [mdn]
• api.CSPViolationReportBody [mdn]
• api.CSPViolationReportBody.blockedURL [mdn]
• api.CSPViolationReportBody.columnNumber [mdn]
• api.CSPViolationReportBody.disposition [mdn]
• api.CSPViolationReportBody.documentURL [mdn]
• api.CSPViolationReportBody.effectiveDirective [mdn]
• api.CSPViolationReportBody.lineNumber [mdn]
• api.CSPViolationReportBody.originalPolicy [mdn]
• api.CSPViolationReportBody.referrer [mdn]
• api.CSPViolationReportBody.sample [mdn]
• api.CSPViolationReportBody.sourceFile [mdn]
• api.CSPViolationReportBody.statusCode [mdn]
• api.CSPViolationReportBody.toJSON [mdn]

]]>

2018-04-30T00:00:00+00:002018-04-30T00:00:00+00:00https://rixx.github.io/baseline-updates/2018/04/30/upgrade-insecure-requestscaniuse · mdn · spec

The Upgrade-Insecure-Requests HTTP request header tells the server that the response should redirect to a secure (HTTPS) resource.

Source features

• http.headers.Content-Security-Policy.upgrade-insecure-requests [mdn]
• http.headers.Upgrade-Insecure-Requests [mdn]

]]>

2018-01-29T00:00:00+00:002018-01-29T00:00:00+00:00https://rixx.github.io/baseline-updates/2018/01/29/corscaniuse · mdn · spec

Cross-Origin Resource Sharing is an HTTP-header based mechanism that allows a server to indicate any origins (domain, scheme, or port) other than its own from which a browser should permit loading resources. Also known as CORS.

Source features

• http.headers.Access-Control-Allow-Credentials [mdn]
• http.headers.Access-Control-Allow-Headers [mdn]
• http.headers.Access-Control-Allow-Methods [mdn]
• http.headers.Access-Control-Allow-Origin [mdn]
• http.headers.Access-Control-Expose-Headers [mdn]
• http.headers.Access-Control-Max-Age [mdn]
• http.headers.Access-Control-Request-Headers [mdn]
• http.headers.Access-Control-Request-Method [mdn]
• http.headers.Access-Control-Allow-Headers.wildcard [mdn]
• http.headers.Access-Control-Allow-Methods.wildcard [mdn]
• http.headers.Access-Control-Expose-Headers.wildcard [mdn]
• http.headers.Access-Control-Allow-Headers.authorization_not_covered_by_wildcard [mdn]

]]>

2018-01-29T00:00:00+00:002018-01-29T00:00:00+00:00https://rixx.github.io/baseline-updates/2018/01/29/hstscaniuse · mdn · spec

The Strict-Transport-Security HTTP response header informs browsers that the site should only be accessed using HTTPS, and that any future attempts to access it using HTTP should automatically be converted to HTTPS. Also known as HSTS.

Source features

• http.headers.Strict-Transport-Security [mdn]

]]>

2016-08-02T00:00:00+00:002016-08-02T00:00:00+00:00https://rixx.github.io/baseline-updates/2016/08/02/cspcaniuse · mdn · spec

Content Security Policy (CSP) helps to mitigate certain security threats, including cross-site scripting (XSS) and clickjacking attacks. It consists of a set of directives from a website to a browser, which instruct the browser to restrict the things that the site is allowed to do.

Source features

• http.headers.Content-Security-Policy [mdn]
• http.headers.Content-Security-Policy-Report-Only [mdn]
• http.headers.Content-Security-Policy.default-src [mdn]
• http.headers.Content-Security-Policy.font-src [mdn]
• http.headers.Content-Security-Policy.frame-src [mdn]
• http.headers.Content-Security-Policy.img-src [mdn]
• http.headers.Content-Security-Policy.media-src [mdn]
• http.headers.Content-Security-Policy.object-src [mdn]
• http.headers.Content-Security-Policy.script-src [mdn]
• http.headers.Content-Security-Policy.style-src [mdn]
• http.headers.Content-Security-Policy.connect-src [mdn]
• http.headers.Content-Security-Policy.sandbox [mdn]
• http.headers.Content-Security-Policy.form-action [mdn]
• http.headers.Content-Security-Policy.child-src [mdn]
• html.elements.meta.http-equiv.content-security-policy [mdn]
• http.headers.Content-Security-Policy.frame-ancestors [mdn]
• http.headers.Content-Security-Policy.upgrade-insecure-requests [mdn]
• http.headers.Content-Security-Policy.meta-element-support [mdn]
• api.Element.securitypolicyviolation_event [mdn]
• api.SecurityPolicyViolationEvent [mdn]
• api.SecurityPolicyViolationEvent.SecurityPolicyViolationEvent [mdn]
• api.SecurityPolicyViolationEvent.blockedURI [mdn]
• api.SecurityPolicyViolationEvent.columnNumber [mdn]
• api.SecurityPolicyViolationEvent.documentURI [mdn]
• api.SecurityPolicyViolationEvent.effectiveDirective [mdn]
• api.SecurityPolicyViolationEvent.lineNumber [mdn]
• api.SecurityPolicyViolationEvent.originalPolicy [mdn]
• api.SecurityPolicyViolationEvent.referrer [mdn]
• api.SecurityPolicyViolationEvent.sourceFile [mdn]
• api.SecurityPolicyViolationEvent.statusCode [mdn]
• api.SecurityPolicyViolationEvent.violatedDirective [mdn]
• api.WorkerGlobalScope.securitypolicyviolation_event [mdn]
• http.headers.Content-Security-Policy.base-uri [mdn]
• http.headers.Content-Security-Policy.manifest-src [mdn]
• http.headers.Content-Security-Policy.worker_support [mdn]
• api.SecurityPolicyViolationEvent.disposition [mdn]
• api.SecurityPolicyViolationEvent.sample [mdn]
• http.headers.Content-Security-Policy.report-sample [mdn]
• api.Document.securitypolicyviolation_event [mdn]
• http.headers.Content-Security-Policy.worker-src [mdn]
• http.headers.Content-Security-Policy.script-src.wasm-unsafe-eval [mdn]
• http.headers.Content-Security-Policy.script-src-attr [mdn]
• http.headers.Content-Security-Policy.script-src-elem [mdn]
• http.headers.Content-Security-Policy.style-src-attr [mdn]
• http.headers.Content-Security-Policy.style-src-elem [mdn]
• http.headers.Content-Security-Policy.unsafe-hashes [mdn]
• http.headers.Content-Security-Policy.script-src.external_scripts [mdn]
• http.headers.Content-Security-Policy.strict-dynamic [mdn]
• api.SecurityPolicyViolationEvent.worker_support [mdn]
• http.headers.Content-Security-Policy.report-to [mdn]
• api.HTMLIFrameElement.csp [mdn]
• html.elements.iframe.csp [mdn]
• api.CSPViolationReportBody [mdn]
• api.CSPViolationReportBody.blockedURL [mdn]
• api.CSPViolationReportBody.columnNumber [mdn]
• api.CSPViolationReportBody.disposition [mdn]
• api.CSPViolationReportBody.documentURL [mdn]
• api.CSPViolationReportBody.effectiveDirective [mdn]
• api.CSPViolationReportBody.lineNumber [mdn]
• api.CSPViolationReportBody.originalPolicy [mdn]
• api.CSPViolationReportBody.referrer [mdn]
• api.CSPViolationReportBody.sample [mdn]
• api.CSPViolationReportBody.sourceFile [mdn]
• api.CSPViolationReportBody.statusCode [mdn]
• api.CSPViolationReportBody.toJSON [mdn]

]]>

2015-07-29T00:00:00+00:002015-07-29T00:00:00+00:00https://rixx.github.io/baseline-updates/2015/07/29/corscaniuse · mdn · spec

Cross-Origin Resource Sharing is an HTTP-header based mechanism that allows a server to indicate any origins (domain, scheme, or port) other than its own from which a browser should permit loading resources. Also known as CORS.

Source features

• http.headers.Access-Control-Allow-Credentials [mdn]
• http.headers.Access-Control-Allow-Headers [mdn]
• http.headers.Access-Control-Allow-Methods [mdn]
• http.headers.Access-Control-Allow-Origin [mdn]
• http.headers.Access-Control-Expose-Headers [mdn]
• http.headers.Access-Control-Max-Age [mdn]
• http.headers.Access-Control-Request-Headers [mdn]
• http.headers.Access-Control-Request-Method [mdn]
• http.headers.Access-Control-Allow-Headers.wildcard [mdn]
• http.headers.Access-Control-Allow-Methods.wildcard [mdn]
• http.headers.Access-Control-Expose-Headers.wildcard [mdn]
• http.headers.Access-Control-Allow-Headers.authorization_not_covered_by_wildcard [mdn]

]]>

2015-07-29T00:00:00+00:002015-07-29T00:00:00+00:00https://rixx.github.io/baseline-updates/2015/07/29/hstscaniuse · mdn · spec

The Strict-Transport-Security HTTP response header informs browsers that the site should only be accessed using HTTPS, and that any future attempts to access it using HTTP should automatically be converted to HTTPS. Also known as HSTS.

Source features

• http.headers.Strict-Transport-Security [mdn]

]]>