diff options
Diffstat (limited to '')
| -rw-r--r-- | docs/WEB-PLAN.md | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/docs/WEB-PLAN.md b/docs/WEB-PLAN.md index 80e797b..d0f9d9d 100644 --- a/docs/WEB-PLAN.md +++ b/docs/WEB-PLAN.md | |||
| @@ -102,11 +102,14 @@ Test against a staging site with | |||
| 102 | logs both fingerprints and refuses credentials. | 102 | logs both fingerprints and refuses credentials. |
| 103 | - The browser has no certificate UI and no credential storage. XSS cannot read | 103 | - The browser has no certificate UI and no credential storage. XSS cannot read |
| 104 | the HttpOnly cookie; the backend still must escape every notice. | 104 | the HttpOnly cookie; the backend still must escape every notice. |
| 105 | - `web/robots.txt` disallows every crawler and the site sends `noindex` | ||
| 106 | headers. The game port is not HTTP: v5 drops a request whose first four bytes | ||
| 107 | are not a valid frame before `HELLO`, without replying or logging. | ||
| 105 | - The browser speaks JSON, not the game wire. A malicious page cannot use the | 108 | - The browser speaks JSON, not the game wire. A malicious page cannot use the |
| 106 | gateway as a protocol proxy: `Origin` is checked and the session cookie is | 109 | gateway as a protocol proxy: `Origin` is checked and the session cookie is |
| 107 | SameSite=Strict. | 110 | SameSite=Strict. |
| 108 | - The web app is play-money only. No deposits, withdrawals, KYC or real-money | 111 | - The web app is play-money only. No deposits, withdrawals, KYC or real-money |
| 109 | claims belong in v1 copy. | 112 | claims belong in v1 copy. Do not advertise it in the player-facing copy. |
| 110 | 113 | ||
| 111 | ## Failure behaviour | 114 | ## Failure behaviour |
| 112 | 115 | ||