shield_lock
金大哥
← 返回 Skill 列表
extension
分类: 开发与工程API Key 暂未确认

general-frontend-security

与框架无关的前端安全指南，基于OWASP安全编码实践。涵盖XSS预防、CSRF保护、内容安全策略(CSP)、安全cookie配置、客户端认证模式、输入验证、安全存储和安全头。适用于任何Web应用程序的安全审计、漏洞审查或浏览器安全问题。不适用于后端/NestJS安全（请使用generating-nest-servers）。不适用于Nuxt特定实现（请使用developing-lt-frontend）。

person作者: jakexiaohubgithub
open_in_new仓库download下载资源包

General Frontend Security

Framework-agnostic security practices for web applications based on OWASP guidelines.

When to Use This Skill

  • Reviewing frontend code for security vulnerabilities
  • Implementing client-side authentication flows
  • Setting up secure cookie handling
  • Configuring Content Security Policy
  • Auditing third-party dependencies
  • General frontend security questions

Skill Boundaries

| User Intent | Correct Skill | |------------|---------------| | "XSS prevention best practices" | THIS SKILL | | "Security audit of frontend" | THIS SKILL | | "Configure CSP headers" | THIS SKILL | | "Build a secure login page in Nuxt" | developing-lt-frontend | | "Fix @Restricted decorator in NestJS" | generating-nest-servers | | "Run npm audit fix" | maintaining-npm-packages |

Related Skills & Commands

| Command | Purpose | |---------|---------| | /lt-dev:review | General security review of branch diff (framework-agnostic) | | /lt-dev:backend:sec-review | Security review of backend code changes (auth, decorators, models) | | /lt-dev:backend:sec-audit | Full OWASP security audit (dependencies, config, code) |

Framework-Specific References

| Framework | Reference File | |-----------|---------------| | Nuxt/Vue | See developing-lt-frontend skill (reference/security.md) | | Angular | angular-security.md |

Key Principles

  1. Never trust client-side validation - Server must always verify
  2. Store tokens securely - Memory for access tokens, httpOnly cookies for refresh tokens
  3. Prevent XSS - Never use innerHTML with user input; use textContent or DOMPurify
  4. Protect against CSRF - Use CSRF tokens for state-changing requests + SameSite cookies
  5. Configure CSP - Restrict script/style sources, use nonces, block framing
  6. Minimize dependencies - Fewer deps = smaller attack surface; always run pnpm audit
  7. Load nothing from a foreign host at runtime - No CDN scripts, fonts, icons or worker files. A third party that serves an asset on every page load can serve different code tomorrow, sees every visitor, and takes the feature down with it when it is unreachable. Ship assets in the build (import url from "pkg/file?url"). See the developing-lt-frontend skill for the failure this rule comes from.

Complete OWASP reference with code examples: owasp-reference.md

Security Checklist

Development

  • [ ] No sensitive data in client-side code
  • [ ] Environment variables separated (public vs private)
  • [ ] Input validation on all user inputs
  • [ ] XSS prevention (no innerHTML with user data)
  • [ ] CSRF tokens for state-changing requests

Authentication

  • [ ] Tokens stored securely (memory + httpOnly cookies)
  • [ ] Token refresh mechanism implemented
  • [ ] Proper logout (clear all client state)
  • [ ] Session timeout configured

Configuration

  • [ ] No third-party hosts in the built app (check the network tab; grep -rnoE "https?://" app/)
  • [ ] HTTPS enforced
  • [ ] CSP headers configured
  • [ ] Security headers set (X-Frame-Options, etc.)
  • [ ] Cookies configured with secure flags
  • [ ] CORS properly restricted

Dependencies

  • [ ] pnpm audit clean (or accepted risks)
  • [ ] pnpm-lock.yaml committed
  • [ ] SRI for external resources
  • [ ] Regular dependency updates

Build & Deploy

  • [ ] Debug mode disabled
  • [ ] Console logs removed
  • [ ] Source maps disabled or restricted
  • [ ] Error messages generic (no stack traces)