diff --git a/static/build.html b/static/build.html index 13dd8415..5a612101 100644 --- a/static/build.html +++ b/static/build.html @@ -1399,15 +1399,13 @@ rm android-cts-media-1.5.zip } } -

Cookies are only used for login sessions. The only other use case considered valid - would be optimizing HTTP/2 Server Push but the intention is only to use that for - render blocking CSS and it's not really worth optimizing for caching when the CSS is - tiny in practice. Every cookie must have the __Host prefix to guarantee - that it has the Secure attribute and Path=/. The - HttpOnly and SameSite=Strict flags should also always be - included. These kinds of cookies can provide secure login sessions in browsers with - fully working SameSite=Strict support. However, CSRF tokens should still - be used for the near future in case there are browser issues.

+

Cookies are only used for login sessions. Every cookie must have the + __Host prefix to guarantee that it has the Secure + attribute and Path=/. The HttpOnly and + SameSite=Strict flags should also always be included. These kinds + of cookies can provide secure login sessions in browsers with fully working + SameSite=Strict support. However, CSRF tokens should still be used + for the near future in case there are browser issues.

For web content, use dashes as user-facing word separators rather than underscores. Page titles should follow the scheme "Page | Directory | Higher-level directory |