What security guidance should we give web developers?

[wbamberg]

Session description

There are a lot of web platform features that relate to security, and they generally have pretty comprehensive documentation on MDN. But there's not a lot of normative guidance: which features should people use (and which should they avoid), why should they use them, and how should they use them?

In the Security Web Application Guidelines Community Group (SWAG CG) we've been trying to understand these questions, partly so we can update MDN with this sort of normative guidance for developers with deadlines. So this very open-ended session is proposed to gather input on security documentation requirements.

Session goal

Security documentation requirements.

Additional session chairs (Optional)

@torgo

Who can attend

Anyone may attend (Default)

IRC channel (Optional)

#mdn-security

Other sessions where we should avoid scheduling conflicts (Optional)

#79, #8, #10, #12, #34

Instructions for meeting planners (Optional)

No response

Agenda for the meeting.

https://wbamberg.github.io/web-security-w3c-breakouts-september-2024/Templates/Overview.html

Links to calendar

• 2024-09-25, 13:15 - 14:15

Meeting materials

• Slides
• Minutes

[tpac-breakout-bot]

Thank you for proposing a session!

You may update the session description as needed and at any time before the meeting, but please keep in mind that tooling relies on issue formatting: follow the instructions and leave all headings and other formatting intact in particular. Bots and W3C meeting organizers may also update the description, to fix formatting issues or add links and other relevant information. Please do not revert these changes. Feel free to use comments to raise questions.

Do not expect formal approval; W3C meeting organizers endeavor to schedule all proposed sessions that are in scope for a breakout. Actual scheduling should take place shortly before the meeting.

[torgo]

Can we also avoid clashing with #70 and #59 if possible? 🙏🏻

[chrisdavidmills]

Note that I recently added these Practical security implementation guides, which are pointed to by the updated HTTP Observatory that now lives on MDN.

I would love to see what else is recommended alongside these, and how you think they could be better structured/positioned.