Defense in depth
Independent controls at different boundaries that reduce reliance on a single mechanism. Multiple copies of the same failure-prone control may not provide independence.
- Defined in
- NIST glossary: defense-in-depth
Covered in
Guide
Configure CORS and CSP around the browser capabilities you need
Control who can read API responses and which resources a page may execute without confusing either control with authorization.
Guide
Operate edge rules without hiding application defects
Tune WAF and abuse controls against legitimate traffic, parser behavior and measurable business effects.
Practice: CORS policy lab: Grant CORS to the right origins only · CSP builder lab: Build a strict Content-Security-Policy · Local project: Repair a real proxy and shared cache