Glossary

Web security glossary for builders

Short definitions for the controls and vulnerability classes that appear in VICE reports, written for people shipping web products.

SECURITY / RLS

RLS

Row Level Security. Database policies that decide which rows each user or role can read, insert, update or delete.

SECURITY / CSP

Content Security Policy. A browser policy that limits where scripts, styles, frames and other resources may load from.

SECURITY / CORS

Cross-Origin Resource Sharing. Response headers that decide which other origins may read a resource in the browser.

SECURITY / HSTS

HTTP Strict Transport Security. A response header that tells browsers to use HTTPS for future requests to the domain.

SECURITY / XSS

Cross-Site Scripting. Untrusted input reaches executable HTML or JavaScript in another user's browser.

SECURITY / SSRF

Server-Side Request Forgery. Attacker-controlled input makes a server request an unintended internal or external destination.

Editorial details