Missing
1. Content security policy headers for web
2. "strict" Samesite cookie flags for CSRF and authentication tokens
Difference of opinion
Didn't argon2 win the last password hashing competition?
1. Content security policy headers for web
2. "strict" Samesite cookie flags for CSRF and authentication tokens
Difference of opinion
Didn't argon2 win the last password hashing competition?
It's like if I said, "you forgot to mention to disable root logins via SSH". While that might certainly be a good recommendation, it's out of scope as it has nothing to do with what is being discussed.