A great introduction to XS-Leaks for web developers and a summary of the opt-in web security features (COOP, CORP, Fetch Metadata headers) that can prevent them.