diff --git a/static/build.html b/static/build.html index 13dd8415..5a612101 100644 --- a/static/build.html +++ b/static/build.html @@ -1399,15 +1399,13 @@ rm android-cts-media-1.5.zip } } -
Cookies are only used for login sessions. The only other use case considered valid
- would be optimizing HTTP/2 Server Push but the intention is only to use that for
- render blocking CSS and it's not really worth optimizing for caching when the CSS is
- tiny in practice. Every cookie must have the __Host
prefix to guarantee
- that it has the Secure
attribute and Path=/
. The
- HttpOnly
and SameSite=Strict
flags should also always be
- included. These kinds of cookies can provide secure login sessions in browsers with
- fully working SameSite=Strict
support. However, CSRF tokens should still
- be used for the near future in case there are browser issues.
Cookies are only used for login sessions. Every cookie must have the
+ __Host
prefix to guarantee that it has the Secure
+ attribute and Path=/
. The HttpOnly
and
+ SameSite=Strict
flags should also always be included. These kinds
+ of cookies can provide secure login sessions in browsers with fully working
+ SameSite=Strict
support. However, CSRF tokens should still be used
+ for the near future in case there are browser issues.
For web content, use dashes as user-facing word separators rather than underscores. Page titles should follow the scheme "Page | Directory | Higher-level directory |