“csrf”的搜索结果

Django security best practices, authentication, authorization, CSRF protection, SQL injection prevention, XSS prevention, and secure deployment configurations.

中文简介正在准备中。当前显示原文说明。

Cross-stack security review — auditing vulnerabilities across infrastructure, smart contracts, CI/CD pipelines, and AI agent systems, plus auth/sessions/crypto and validating user input at API and infrastructure boundaries. Triggers on mentions of "vulnerability", "pentest", "OWASP", "access control", "injection", "CSRF", "JWT", "smart contract audit", "supply chain", "OIDC", or any review of security-sensitive code paths spanning more than one layer. For PII sanitization see [security](../security/SKILL.md).

中文简介正在准备中。当前显示原文说明。

Use when applying security best practices — authentication, authorization, CSRF protection, input sanitization, rate limiting, or secure coding — stack-agnostic.

中文简介正在准备中。当前显示原文说明。

Practical security review and hardening guidance for application code in Python, JavaScript/TypeScript, and Go. Use this skill whenever the user asks for a security review or audit, wants to harden authentication (password hashing, sessions, JWT, OAuth2/OIDC, MFA), fix OWASP Top 10 issues (injection, XSS, IDOR, CSRF, SSRF, deserialization), threat-model with STRIDE, clean up secrets and .env handling, or set up dependency scanning (pip-audit, npm audit, osv-scanner, gitleaks, SBOM). Also trigger for "make this secure", "is this safe to deploy", bcrypt/argon2id, rate limiting logins, RBAC/ABAC, CSP and security headers, cookie flags, and secure-by-default coding help.

中文简介正在准备中。当前显示原文说明。

Deep security audit for WordPress plugin/theme PHP code, covering issues beyond the basic sanitize/escape/nonce checklist — PHP object injection (unserialize), SSRF in remote requests, CSRF on state-changing GET handlers, mass assignment via $_POST loops, insecure file include / template injection, mail header injection, ZipSlip in archive extraction, type-juggling in auth comparisons, and TOCTOU race patterns in option/meta locks. Use after or alongside wp-security-audit when reviewing complex plugins, REST APIs, integrations that fetch remote URLs, file processors, or any code that handles uploads, archives, or self-rolled auth tokens.

中文简介正在准备中。当前显示原文说明。

Tests OAuth 2.0 and OpenID Connect implementations for security flaws including authorization code interception, redirect URI manipulation, CSRF in OAuth flows, token leakage, scope escalation, and PKCE bypass. The tester evaluates the authorization server, client application, and token handling for common misconfigurations that enable account takeover or unauthorized access. Activates for requests involving OAuth security testing, OIDC vulnerability assessment, OAuth2 redirect bypass, or aut...

中文简介正在准备中。当前显示原文说明。

How to identify and test for account takeover vulnerabilities in web applications. Use this skill whenever the user mentions account takeover, authentication bypass, password reset attacks, email verification bypass, session hijacking, or any technique to compromise user accounts. This includes testing authorization issues, unicode normalization attacks, reset token reuse, CORS/CSRF/XSS exploitation, cookie manipulation, and OAuth vulnerabilities.

中文简介正在准备中。当前显示原文说明。

Use when you need to design, review, or improve security in Micronaut applications — including micronaut-security authentication, @Secured and intercept-url-map rules, JWT/session strategies, SecurityService checks, CORS, CSRF awareness for browser apps, rejection handlers, and sensitive-data-safe logging. This should trigger for requests such as Add Micronaut security support; Review Micronaut security configuration; Improve API authorization in Micronaut; Add JWT security in Micronaut; Harden Micronaut route authorization rules. Part of cursor-rules-java project

中文简介正在准备中。当前显示原文说明。

Hono (軽量・マルチランタイム対応 Web フレームワーク) リファレンス。 Hono App, Context (c.req / c.json / c.text / c.html), HonoRequest, Routing, HTTPException、 Built-in Middleware (JWT, CORS, CSRF, Cache, Logger, Compress, Basic / Bearer Auth, Mount)、 Helpers (Cookie, Streaming, WebSocket, Factory, RPC)、 Cloudflare Workers / Deno / Bun / Node.js / AWS Lambda 対応、@hono/* アダプターパッケージ。

中文简介正在准备中。当前显示原文说明。

Echo (LabStack) v5 — Go Web framework リファレンス。routing（Group）、echo.Context、 Bind、Validator、HTTPError、HTTPErrorHandler、RFC 9457 Problem Details、 middleware（JWT, CORS, CSRF, BasicAuth, Gzip, Recover, Logger, RateLimiter）、 OpenTelemetry (echo-otel)、IPExtractor、SchemeExtractor、Renderer、WebSocket、SSE、 AutoTLS 実装例。

中文简介正在准备中。当前显示原文说明。

Secures Spring Security filters, JWT validations, OAuth2 setups, and CORS/CSRF headers.

中文简介正在准备中。当前显示原文说明。

Review and harden web apps (authz, XSS, CSRF, SSRF, injection) on code you maintain. Complements the OWASP `security` skill. No exploit kits.

中文简介正在准备中。当前显示原文说明。

Spring Security best practices for authn/authz, validation, CSRF, secrets, headers, rate limiting, and dependency security in Java Spring Boot services.

中文简介正在准备中。当前显示原文说明。

Debug Spring Boot issues systematically. Use when encountering bean errors like NoSuchBeanDefinitionException, circular dependency issues, application startup failures, JPA/Hibernate problems including LazyInitializationException and N+1 queries, security misconfigurations causing 403 Forbidden errors, property binding failures, CSRF token issues, or any Spring Boot application requiring diagnosis with Actuator endpoints and JVM debugging.

中文简介正在准备中。当前显示原文说明。

Implement comprehensive security patterns to protect applications against OWASP Top 10 vulnerabilities including XSS, CSRF, SQL injection, authentication bypass, and data exposure. Use when handling user data, implementing authentication and authorization, validating input, encrypting sensitive data, preventing injection attacks, securing API endpoints, managing sessions and tokens, implementing rate limiting, configuring security headers, or building security-critical features that require defense-in-depth protection.

中文简介正在准备中。当前显示原文说明。

Comprehensive Perl security covering taint mode, input validation, safe process execution, DBI parameterized queries, web security (XSS/SQLi/CSRF), and perlcritic security policies.

中文简介正在准备中。当前显示原文说明。

Spring Security best practices for authn/authz, validation, CSRF, secrets, headers, rate limiting, and dependency security in Java Spring Boot services.

中文简介正在准备中。当前显示原文说明。

Django security best practices, authentication, authorization, CSRF protection, SQL injection prevention, XSS prevention, and secure deployment configurations.

中文简介正在准备中。当前显示原文说明。

Authentication and authorization patterns - JWT, OAuth2, sessions, RBAC, ABAC, passkeys, and MFA. Use for: authentication, authorization, jwt, oauth, oauth2, session, login, rbac, abac, passkey, mfa, totp, api key, token, auth, cookie, csrf, cors credentials, bearer token, refresh token, oidc.

中文简介正在准备中。当前显示原文说明。

Implements secure authentication patterns including login/registration, session management, JWT tokens, password hashing, cookie settings, and CSRF protection. Provides auth routes, middleware, security configurations, and threat model documentation. Use when building "authentication", "login system", "JWT auth", or "session management".

中文简介正在准备中。当前显示原文说明。

OAuth 2.0 attack checklist: authorization code interception, redirect_uri bypass, CSRF on OAuth flow, state parameter abuse, open redirector chaining, token leakage via Referer, PKCE bypass, and scope escalation. Use when testing OAuth implementations in web apps or bug bounty.

中文简介正在准备中。当前显示原文说明。

Complete bug bounty workflow — recon (subdomain enumeration, asset discovery, fingerprinting, HackerOne scope, source code audit), pre-hunt learning (disclosed reports, tech stack research, mind maps, threat modeling), vulnerability hunting (IDOR, SSRF, XSS, auth bypass, CSRF, race conditions, SQLi, XXE, file upload, business logic, GraphQL, HTTP smuggling, cache poisoning, OAuth, timing side-channels, OIDC, SSTI, subdomain takeover, cloud misconfig, ATO chains, agentic AI), LLM/AI security testing (chatbot IDOR, prompt injection, indirect injection, ASCII smuggling, exfil channels, RCE via code tools, system prompt extraction, ASI01-ASI10), A-to-B bug chaining (IDOR→auth bypass, SSRF→cloud metadata, XSS→ATO, open redirect→OAuth theft, S3→bundle→secret→OAuth), bypass tables (SSRF IP bypass, open redirect bypass, file upload bypass), language-specific grep (JS prototype pollution, Python pickle, PHP type juggling, Go template.HTML, Ruby YAML.load, Rust unwrap), and reporting (7-Question Gate, 4 validation ...

中文简介正在准备中。当前显示原文说明。

Local-tooling companion to the bug-bounty orchestrator — carries the SAME complete bug-bounty workflow, but reach for THIS variant when you also need to resolve where tools, wordlists, and clones are installed on the local machine (jhaddix, SecLists, trufflehog, ffuf, dalfox, ghauri); for pure orchestration/routing use the bug-bounty skill. Workflow it covers — recon (subdomain enumeration, asset discovery, fingerprinting, HackerOne scope, source code audit), pre-hunt learning (disclosed reports, tech stack research, mind maps, threat modeling), vulnerability hunting (IDOR, SSRF, XSS, auth bypass, CSRF, race conditions, SQLi, XXE, file upload, business logic, GraphQL, HTTP smuggling, cache poisoning, OAuth, timing side-channels, OIDC, SSTI, subdomain takeover, cloud misconfig, ATO chains, agentic AI), LLM/AI security testing (chatbot IDOR, prompt injection, indirect injection, ASCII smuggling, exfil channels, RCE via code tools, system prompt extraction, ASI01-ASI10), A-to-B bug chaining (IDOR→auth bypass...

中文简介正在准备中。当前显示原文说明。