8 lines
523 B
Markdown
8 lines
523 B
Markdown
# Web and frontend security
|
|
|
|
* Escape or sanitize untrusted content; never inject untrusted HTML or bypass framework sanitization.
|
|
* Protect state-changing browser requests from CSRF where applicable.
|
|
* Use `HttpOnly`, `Secure`, and appropriate `SameSite` cookie settings for sensitive sessions.
|
|
* Validate redirect targets, avoid sensitive data in URLs, and use CSP and clickjacking protections where applicable.
|
|
* Treat frontend code and browser storage as visible and never rely on client-side checks for authorization.
|