Web Security · Senior · Question 24 of 75
What does a resource isolation policy based on Fetch Metadata do?
if (req.headers['sec-fetch-site'] === 'cross-site' &&
!(req.headers['sec-fetch-mode'] === 'navigate' && req.method === 'GET')) {
return res.status(403).end();
}- 1Blocks users from opening the site in a new tab
- ✓Correct answer: Rejects cross-site requests to the app except simple top-level navigations, cutting off CSRF, XSSI and many XS-Leaks
- 3Allows only requests from search engines
Explanation
Endpoints meant to be embedded or called cross-site (public APIs, images for other sites) need explicit exceptions.