feat(config): validate clients and scope security

2026-09-14 01:07:46 +02:00
parent 5b0c623a8d
commit a3cee2756c
17 changed files with 230 additions and 437 deletions
@@ -0,0 +1,7 @@
+# Web and frontend security
+
+* Escape or sanitize untrusted content; never inject untrusted HTML or bypass framework sanitization.
+* Protect state-changing browser requests from CSRF where applicable.
+* Use `HttpOnly`, `Secure`, and appropriate `SameSite` cookie settings for sensitive sessions.
+* Validate redirect targets, avoid sensitive data in URLs, and use CSP and clickjacking protections where applicable.
+* Treat frontend code and browser storage as visible and never rely on client-side checks for authorization.