From b54c3d61d08dc0fb14a94ece30820f538b73ffbb Mon Sep 17 00:00:00 2001 From: Julian Lechner Date: Thu, 24 Sep 2026 22:04:13 +0200 Subject: [PATCH] docs(security): strengthen web guidance --- shared/rules/security/references/web.md | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/shared/rules/security/references/web.md b/shared/rules/security/references/web.md index 48225e0..3427cdf 100644 --- a/shared/rules/security/references/web.md +++ b/shared/rules/security/references/web.md @@ -1,7 +1,11 @@ # Web and frontend security * Escape or sanitize untrusted content; never inject untrusted HTML or bypass framework sanitization. -* Protect state-changing browser requests from CSRF where applicable. -* Use `HttpOnly`, `Secure`, and appropriate `SameSite` cookie settings for sensitive sessions. -* Validate redirect targets, avoid sensitive data in URLs, and use CSP and clickjacking protections where applicable. -* Treat frontend code and browser storage as visible and never rely on client-side checks for authorization. +* Encode output for its exact context (HTML, attributes, JavaScript, CSS, or URL). Prefer text APIs and framework-safe templates; use a maintained sanitizer only when rich HTML is required. +* Protect state-changing browser requests from CSRF where applicable; validate origin or anti-CSRF tokens and do not treat CORS as authorization. +* Use `HttpOnly`, `Secure`, and appropriate `SameSite` cookie settings for sensitive sessions. Rotate session IDs after authentication and privilege changes. +* Validate redirect targets against an allowlist. Avoid sensitive data in URLs, referrers, browser history, analytics, and error reports. +* Apply restrictive Content Security Policy and clickjacking protections where applicable. Do not weaken security headers to accommodate unsafe inline content without a reviewed design. +* Treat frontend code, source maps, and browser storage as visible. Never place secrets there or rely on client-side checks for authorization. +* Protect state-changing operations against clickjacking and unintended form submissions when relevant; require explicit confirmation for high-impact actions. +* Keep dependencies and third-party scripts minimal. Apply integrity and origin controls to externally hosted resources where supported.