The Web Platform Is Full Of Security Features That Look Like Bugs

How I debug browser security features that look like broken code: CORS, SameSite cookies, mixed content, CSP, iframe permissions, and isolation headers.