Security defaults

This chapter is not written yet.

It will cover the door’s defaults and why each exists: the page CSP with no inline script or style, the Origin check on every unsafe method, cookies that carry authority only for their own origin, HTML the door did not write served so it cannot run, one escaping rule set and one way to put a value in a URL. The inspector runs behind these already (htmx: server-rendered HTML with push); this chapter will say what each one stops.