recursal/MDN huggingface dataset:
<xsl:apply-templates>
=====================

The `<xsl:apply-templates>` element selects a set of nodes in the input tree and instructs the processor to apply the proper templates to them.

### Syntax


```xml
<xsl:apply-templates select=EXPRESSION mode=NAME>
  <xsl:with-param> [optional]
  <xsl:sort> [optional]
</xsl:apply-templates>
```

### Required Attributes

None.

### Optional Attributes

`select`

Uses an XPath expression that specifies the nodes to be processed. An asterisk(`*`) selects the entire node-set. If this attribute is not set, all child nodes of the current node are selected.

`mode`

If there are multiple ways of processing defined for the same node, distinguishes among them.

### Type

Instruction, appears within a template.

### Defined

XSLT section 5.4.

### Gecko support

Supported.
<xsl:param>
===========

The `<xsl:param>` element establishes a parameter by name and, optionally, a default value for that parameter. When used as a top-level element, the parameter is global. When used inside an `<xsl:template>` element, the parameter is local to that template. In this case it must be the first child element of the template.

### Syntax


```xml
<xsl:param name=NAME select=EXPRESSION>
  TEMPLATE
</xsl:param>
```

### Required Attributes

`name`

Names the parameter. This must be a QName.

### Optional Attributes

`select`

Uses an XPath expression to provide a default value if none is specified.

### Type

Instruction, can appear as a top-level element or within a template.

### Defined

XSLT, section 11.

### Gecko support

Supported.
<xsl:key>
=========

The `<xsl:key>` element declares a named key which can be used elsewhere in the stylesheet with the `key( )` function.

### Syntax


```xml
<xsl:key name=NAME match=EXPRESSION
 use=EXPRESSION />
```

### Required Attributes

`name`

Specifies a name for this key. Must be a QName.

`match`

Defines the nodes for which this key is applicable.

`use`

Specifies an XPath expression that will be used to determine the value of the key for each of the applicable nodes.

### Optional Attributes

None.

### Type

Top-level, must be the child of `<xsl:stylesheet>` or `<xsl:transform>`.

### Defined

XSLT, section 12.2.

### Gecko support

Supported.
<xsl:call-template>
===================

The `<xsl:call-template>` element invokes a named template.

### Syntax


```xml
<xsl:call-template name=NAME>
  <xsl:with-param> [optional]
</xsl:call-template>
```

### Required Attribute

`name`

Specifies the name of the template you wish to invoke.

### Optional Attributes

None.

### Type

Instruction, appears within a template.

### Defined

XSLT, section 6.

### Gecko support

Supported.
<xsl:text>
==========

The `<xsl:text>` element writes literal text to the output tree. It may contain `#PCDATA`, literal text, and entity references.

### Syntax


```xml
<xsl:text disable-output-escaping="yes" | "no">
  TEXT
</xsl:text>
```

### Required Attributes

None.

### Optional Attributes

`disable-output-escaping` (Netscape does not serialize the result of transformation - the "output" below - so this attribute is essentially irrelevant in context. To output html-entities, use numerical values instead, eg `&#160;` for `&nbsp;`)

Specifies whether special characters are escaped when written to the output. The available values are "`yes`" or "`no`". If "`yes`" is set, for example, the character `>` is output as `>`, not as `&gt;`.

### Type

Instruction, appears within a template.

### Defined

XSLT, section 7.2

### Gecko support

Supported as noted.
<xsl:value-of>
==============

The `<xsl:value-of>` element evaluates an XPath expression, converts it to a string, and writes that string to the result tree.

### Syntax


```xml
<xsl:value-of select=EXPRESSION disable-output-escaping="yes" | "no" />
```

### Required Attributes

`select`

Specifies the XPath expression to be evaluated and written to the output tree.

### Optional Attributes

`disable-output-escaping` (Netscape does not serialize the result of transformation - the "output" below - so this attribute is essentially irrelevant in context. To output html-entities, use numerical values instead, eg `&#160` for `&nbsp`)

Specifies whether special characters are escaped when written to the output. The available values are "`yes`" or "`no`". If "`yes`" is set, for example, the character > is output as `>`, not as "`&gt`".

### Type

Instruction, appears with a template.

### Defined

XSLT, section 7.6.1.

### Gecko support

Supported except as above.
<xsl:attribute>
===============

The `<xsl:attribute>` element creates an attribute in the output document, using any values that can be accessed from the stylesheet. The element must be defined before any other output document element inside the output document element for which it establishes attribute values. But it may be after or inside elements that won't be part of the output (like `<xsl:choose>` or `<xsl:apply-templates>` etc.).

### Syntax


```xml
<xsl:attribute name=NAME namespace=URI>
  TEMPLATE
</xsl:attribute>
```

### Required Attributes

`name`

Specifies the name of the attribute to be created in the output document. The name must be a valid QName.

### Optional Attributes

`namespace`

Defines the namespace URI for this attribute in the output document. You cannot set the related namespace prefix with this element.

### Type

Instruction, appears within a template or an `<xsl:attribute-set>` element.

### Defined

XSLT, section 7.1.3.

### Gecko support

Supported.
<xsl:include>
=============

The `<xsl:include>` element merges the contents of one stylesheet with another. Unlike the case of `<xsl:import>`, the contents of an included stylesheet have exactly the same precedence as the contents of the including stylesheet.

### Syntax


```xml
<xsl:include href=URI />
```

### Required Attributes

`href`

Specifies the URI of the stylesheet to include.

### Optional Attributes

None.

### Type

Top-level, may appear in any order as a child of `<xsl:stylesheet>` or `<xsl:transform>`.

### Defined

XSLT, section 2.6.1.

### Gecko support

Supported.
<xsl:strip-space>
=================

The `<xsl:strip-space>` element defines the elements in the source document for which whitespace should be removed.

### Syntax


```xml
<xsl:strip-space elements=LIST-OF-ELEMENT-NAMES />
```

### Required Attributes

`elements`

Specifies a space-separated list of elements in the source whose whitespace-only text nodes should be removed.

### Optional Attributes

None.

### Type

Top-level, must be a child of `<xsl:stylesheet>` or `<xsl:transform>`.

### Defined

XSLT, section 3.4

### Gecko support

Supported.
<xsl:apply-imports>
===================

The `<xsl:apply-imports>` element is fairly arcane, used mostly in complex stylesheets. Import precedence requires that template rules in main stylesheets have higher precedence than template rules in imported stylesheets. Sometimes, however, it is useful to be able to force the processor to use a template rule from the (lower precedence) imported stylesheet rather than an equivalent rule in the main stylesheet.

### Syntax


```xml
<xsl:apply-imports/>
```

### Required Attributes

None.

### Optional Attributes

None.

### Type

Instruction, appears within a template.

### Defined

XSLT, section 5.6.

### Gecko support

Supported.
<xsl:processing-instruction>
============================

The `<xsl:processing-instruction>` element writes a processing instruction to the output document.

### Syntax

`<xsl:processing-instruction name=NAME> TEMPLATE </xsl:processing-instruction>`

### Required Attributes

`name`

Specifies the name of this processing instruction.

### Optional Attributes

None.

### Type

Instruction, appears within a template.

### Defined

XSLT, section 7.3

### Gecko support

Supported.
<xsl:attribute-set>
===================

The `<xsl:attribute-set>` element creates a named set of attributes, which can then be applied as whole to the output document, in a manner similar to named styles in CSS.

### Syntax


```xml
<xsl:attribute-set name=NAME use-attribute-sets=LIST-OF-NAMES>
  <xsl:attribute>
</xsl:attribute-set>
```

### Required Attributes

`name`

Specifies the name of the attribute set. The name must be a valid QName.

### Optional Attributes

`use-attribute-sets`

Builds an attribute set from other attribute sets. The names of the contributing sets must be separated with whitespace characters and must not directly or indirectly embed themselves.

### Type

Top-level, must be the child of `<xsl:stylesheet>` or `<xsl:transform>`.

### Defined

XSLT, section 7.1.4.

### Gecko support

Supported.
<xsl:preserve-space>
====================

The `<xsl:preserve-space>` element defines the elements in the source document for which whitespace should be preserved. If there is more than one element, separate the names with a whitespace character. Preserving whitespace is the default setting, so this element only needs to be used to counteract an `<xsl:strip-space>` element.

### Syntax


```xml
<xsl:preserve-space elements=LIST-OF-ELEMENT-NAMES />
```

### Required Attributes

`elements`

Specifies the elements for which whitespace should be preserved.

### Optional Attributes

None.

### Type

Top-level, must be a child of `<xsl:stylesheet>` or `<xsl:transform>`.

### Defined

XSLT, section 3.4

### Gecko support

Supported.
Insecure passwords
==================

Serving login forms over HTTP is especially dangerous because of the wide variety of attacks that can be used against them to extract a user's password. Network eavesdroppers could steal a user's password by sniffing the network, or by modifying the served page in transit.

The HTTPS protocol is designed to protect user data from eavesdropping (confidentiality) and from modification (integrity) on the network. Websites that handle user data should use HTTPS to protect their users from attackers. If a website uses HTTP instead of HTTPS, it is trivial to steal user information (such as their login credentials). This was famously demonstrated by Firesheep.

To fix this issue, install and configure a TLS certificate on your server. There are various vendors offering free and paid certificates. If you are using a cloud platform, it may have its own ways of enabling HTTPS.

Note on password reuse
----------------------

Sometimes websites require username and passwords but don't actually store data that is very sensitive. For example, a news site may save which news articles a user wants to go back to and read, but not save any other data about a user. Web developers of the news site may be less motivated to secure their site and their user credentials.

Unfortunately, password reuse is a big problem. Users use the same password across multiple sites (news websites, social networks, email providers, banks). Hence, even if access to the username and password to your site doesn't seem like a huge risk to you, it is a great risk to users who have used the same username and password to log in to their bank accounts. Attackers are getting smarter; they steal username/password pairs from one site and then try reusing them on more lucrative sites.

See also
--------

* No More Passwords over HTTP, Please! — detailed blog post with more information, and FAQ.
Weak signature algorithms
=========================

The strength of the hash algorithm used in signing a digital certificate is a critical element of the security of the certificate. This article provides some information about signature algorithms known to be weak, so you can avoid them when appropriate.

Weaknesses in hash algorithms can lead to situations in which attackers can create or obtain fraudulent certificates. As new attacks are found and improvements in available technology make attacks more feasible, the use of older algorithms is discouraged and support for them is eventually removed.

SHA-1
-----

SHA-1 certificates will no longer be treated as secure by major browser manufacturers beginning in 2017. Certificates employing more secure hash algorithms (such as SHA-256 or SHA-512) should be used instead.

MD5
---

Support for MD5 based signatures was removed in early 2012.

See also
--------

* Mozilla Security Blog post on the deprecation of SHA-1
How to fix a website with blocked mixed content
===============================================

Starting with Firefox 23, Firefox blocks active mixed content by default. This follows a practice adopted by Chrome.

This page explains what you should be aware of as a web developer.

Your website may break
----------------------

If your website delivers HTTPS pages, all active mixed content delivered via HTTP on this pages will be blocked by default. Consequently, your website may appear broken to users (if iframes or plugins don't load, etc.). Passive mixed content is displayed by default, but users can set a preference to block this type of content, as well.

Note that since mixed content blocking already happens in Chrome, it is very likely that if your website works in Chrome, it will work equally well in Firefox with mixed content blocking.

In any case, the best way to know if something is broken in Firefox is to download the latest Firefox Edition, open different pages on your website with the web console open (enable the "Security" messages) and see if anything related to mixed content is reported. Or use a free online crawler like SSL-check or Missing Padlock, a desktop crawler like HTTPSChecker, or a CLI tool like mcdetect to check your website recursively and find links to insecure content. If nothing is said about mixed content, your website is in good shape: Keep making excellent websites!

How to fix your website
-----------------------

The best strategy to avoid mixed content blocking is to serve all the content as HTTPS instead of HTTP.

**For your own domain,** serve all content as HTTPS and fix your links. Often, the HTTPS version of the content already exists and this just requires adding an "s" to links - http:// to https://.

However, in some cases, the path may just be incorrect to the media in question. There are online as well as offline tools (depending on your operating system) such as linkchecker to help resolve this.

**For other domains,** use the site's HTTPS version if available. If HTTPS is not available, you can try contacting the domain and asking them if they can make the content available via HTTPS.
Features restricted to secure contexts
======================================

This reference lists the web platform features available only in secure contexts — see Secure Contexts for a definition and more details.

Current features available only in secure contexts
--------------------------------------------------

This section lists APIs that specifications make available only in secure contexts.

* Async Clipboard API
* Audio Output Devices API
* Background Fetch API
* Background Synchronization API
* Badging API
* Barcode Detection API
* Battery Status API
* `Cache-Control: immutable`
* Contact Picker API
* Content Index API
* Cookie Store API
* Credential Management API
* Device Memory API
* Device Orientation / Device Motion
* Document Picture-in-Picture API
* EyeDropper API
* Encrypted Media Extensions
* File System API
* Generic Sensor API
* Gamepad API
* Geolocation API
* Idle Detection API
* Keyboard API
* Local Font Access API
* Notifications API
* Payment Handler API
* Payment Request API
* Presentation API
* Push API
* Reporting API
* Screen Capture API
* Screen Wake Lock API
* Service Workers
* Shared Storage API
* Storage API
* VirtualKeyboard API
* Web Authentication API
* Web Bluetooth
* Web Locks API
* Web MIDI
* Web NFC API
* Web Crypto API
* WebCodecs API
* WebGPU API
* WebHID API
* WebOTP API
* WebTransport API
* WebUSB API
* WebXR Device API
* Web Share API
* Window Management API

In addition, the following methods require a secure context (even if the associated API does not):

* `MediaDevices.getUserMedia()`
* `Navigator.registerProtocolHandler()`
See also
--------

* Secure contexts
* "secure context" query on Chrome Platform Status
Accessibility information for web authors
=========================================

Guidelines and Regulations
--------------------------

1. ARIA Authoring Practices Guide (APG)
 Guide to accessibility semantics defined by the Accessible Rich Internet Application (ARIA) specification to create accessible web experiences. Describes how to apply accessibility semantics to common design patterns and widgets, providing design patterns and functional examples.
2. Web Content Accessibility Guidelines (WCAG)
 Another important set of guidelines from the W3C *Web Accessibility Initiative (WAI)*. The European Union is looking to base their upcoming accessibility regulations on these guidelines. These guidelines are discussed on the WAI interest group discussion list.
3. ARIA on this site
MDN guide to all the ARIA roles and ARIA properties, including best practices, related roles and properties, and examples.
How-to's
--------

1. Accessibility for frontend developers
 A brief guide from the U.S. General Services administration's Technology Transformation Services covering several accessibility topics with links to "how-to" videos and to related WCAG references.
2. Accessible Web Page Authoring
 IBM has made their accessibility requirements that need to be met public and interactive.
### Automated Checking & Repair

Use a tool to quickly check for common errors in your browser.

* HTML CodeSniffer
* aXe
* Lighthouse Accessibility Audit
* Accessibility Insights
* WAVE

Tools to integrate into your build process, programmatically adding accessibility tests, so you can catch errors as you develop your web application:

* axe-core
* jsx-a11y
* Lighthouse Audits
* AccessLint.js

Continuous integration tools to find accessibility issues in your GitHub pull requests:

* AccessLint

While best to test your web applications with real users, you can simulate color blindness, low vision, low and contrast, and zooming. You should always test your site with out a mouse and touch to test keyboard navigation. You may also want to try your site using voice commands. Try disabling your mouse and using browser extensions like Web Disability Simulator
Multipart labels: Using ARIA for labels with embedded fields inside them
========================================================================

Problem
-------

You have a form where you ask your user a question, but the answer is mentioned in the question itself. A classic example we all know from our browser settings is the setting "Delete history after x days". "Delete history after" is to the left of the textbox, x is the number, for example 21, and the word "days" follows the textbox, forming a sentence that is easy to understand.

If you're using a screen reader, have you noticed that, when you go to this setting in Firefox, it tells you "Delete history after 21 days"?, followed by the announcement that you're in a textbox, and that it contains the number 21. Isn't that cool? You do not need to navigate around to find out the unit. "Days" could easily be "months" or "years", and in many ordinary dialogs, there is no way to find this out other than navigating around with screen reviewing commands.

The solution is in an ARIA attribute called `aria-labelledby`. Its parameter is a string that consists of the IDs of the HTML elements you want to concatenate into a single accessible name.

Both `aria-labelledby` and `aria-describedby` are specified on the form element that is to be labelled, for example an `<input>` In both cases, the label for/label control bindings that may also exist are overridden by `aria-labelledby`. If on an HTML page you provide `aria-labelledby`, you should also provide a label for construct to also support older browsers that do not have ARIA support yet. With Firefox 3, your visually impaired users will automatically get better accessibility from the new attribute, but the users of older browsers are not left in the dark this way.

### Example
```

body {
  margin: 1rem;
}
```



```html
<input
 aria-labelledby="labelShutdown shutdownTime shutdownUnit"
 type="checkbox" />

<span id="labelShutdown">Shut down computer after</span>

<input
 aria-labelledby="labelShutdown shutdownTime shutdownUnit"
 id="shutdownTime"
 type="text"
 value="10" />

<span id="shutdownUnit"> minutes</span>
```

A Note for JAWS 8 users
-----------------------

JAWS 8.0 has its own logic to find labels, causing it to always override the accessibleName the textbox of an HTML document gets. With JAWS 8, I have not found a way to make it to accept the label from the example above. But NVDA and Window-Eyes do it just fine, and Orca on Linux also has no problems.

**Note:** TBD: add more compatibility info

Can this be done without ARIA?
------------------------------

Community member Ben Millard has pointed out in a blog post that controls can be embedded in labels as shown in the above example using HTML 4, by embedding the input into the label. Thanks for that info, Ben! It is very useful and shows that some techniques that have been available for years escape even the gurus sometimes. This technique works in Firefox; however, it doesn't currently work in many other browsers, including IE. For labels with embedded form controls, using `aria-labelledby` is still the best approach.
Using ARIA: Roles, states, and properties
=========================================

ARIA defines semantics that can be applied to elements, with these divided into **roles** (defining a type of user interface element) and **states** and **properties** that are supported by a role. Authors must assign an ARIA role and the appropriate states and properties to an element during its life-cycle, unless the element already has appropriate ARIA semantics (via use of an appropriate HTML element). Addition of ARIA semantics only exposes extra information to a browser's accessibility API, and does not affect a page's DOM.

Roles
-----

### Widget roles

* `button`
* `checkbox`
* `gridcell`
* `link`
* `menuitem`
* `menuitemcheckbox`
* `menuitemradio`
* `option`
* `progressbar`
* `radio`
* `scrollbar`
* `searchbox`
* `separator` (when focusable)
* `slider`
* `spinbutton`
* `switch`
* `tab`
* `tabpanel`
* `textbox`
* `treeitem`
### Composite roles

The techniques below describe each composite role as well as their required and optional child roles.

* `combobox`
* `grid` (including `row`, `gridcell`, `rowheader`, `columnheader` roles)
* `listbox` (including `option` role)
* `menu`
* `menubar`
* `radiogroup` (see `radio role`)
* `tablist` (including `tab` and `tabpanel` roles)
* `tree`
* `treegrid`
### Document structure roles

* `application`
* `article`
* `cell`
* `columnheader`
* `definition`
* `directory`
* `document`
* `feed`
* `figure`
* `group`
* `heading`
* `img`
* `list`
* `listitem`
* `math`
* `none`
* `note`
* `presentation`
* `row`
* `rowgroup`
* `rowheader`
* `separator`
* `table`
* `term`
* `toolbar`
* `tooltip`
### Landmark roles

* `banner`
* `complementary`
* `contentinfo`
* `form`
* `main`
* `navigation`
* `region`
* `search`
### Live Region Roles

* `alert`
* `log`
* `marquee`
* `status`
* `timer`
### Window Roles

* `alertdialog`
* `dialog`
States and properties
---------------------

### Widget attributes

* `aria-autocomplete`
* `aria-checked`
* `aria-current`
* `aria-disabled`
* `aria-errormessage`
* `aria-expanded`
* `aria-haspopup`
* `aria-hidden`
* `aria-invalid`
* `aria-label`
* `aria-level`
* `aria-modal`
* `aria-multiline`
* `aria-multiselectable`
* `aria-orientation`
* `aria-placeholder`
* `aria-pressed`
* `aria-readonly`
* `aria-required`
* `aria-selected`
* `aria-sort`
* `aria-valuemax`
* `aria-valuemin`
* `aria-valuenow`
* `aria-valuetext`
### Live region attributes

* `aria-live`
* `aria-relevant`
* `aria-atomic`
* `aria-busy`
### Drag & drop attributes

* `aria-dropeffect` 
Deprecated
* `aria-grabbed` 
Deprecated
### Relationship attributes

* `aria-activedescendant`
* `aria-colcount`
* `aria-colindex`
* `aria-colspan`
* `aria-controls`
* `aria-describedby`
* `aria-details`
* `aria-errormessage`
* `aria-flowto`
* `aria-labelledby`
* `aria-owns`
* `aria-posinset`
* `aria-rowcount`
* `aria-rowindex`
* `aria-rowspan`
* `aria-setsize`
### MicrosoftEdge-specific properties

* `x-ms-aria-flowfrom` 
Non-standard