20 个 · 按相关度排序
Review cross-origin isolation, a browser security mode required by features such as SharedArrayBuffer. Check response headers and external resources, identify integrations that could break, and verify that isolation actually works in the browser.
中文简介正在准备中。当前显示英语简介。
Review communication between different websites for security issues. Inspect code and browser behavior to identify overly broad CORS permissions, unchecked message senders, missing request protections, and unsafe redirects, then propose fixes and browser checks.
中文简介正在准备中。当前显示英语简介。
Implement Google sign-in for web applications using Google Identity Services. Add sign-in buttons or One Tap, verify ID tokens as proof of identity, configure browser security policies, and handle sessions, sign-out, and account disconnection.
中文简介正在准备中。当前显示英语简介。
CORS misconfiguration testing playbook. Use when analyzing cross-origin trust, credentialed browser reads, origin reflection, preflight policy bugs, and browser-based access to authenticated APIs.
中文简介正在准备中。当前显示原文说明。
Inspects and configures the security headers a Power Pages site sends to browsers — Content Security Policy, frame and clickjacking protection, cross-origin sharing, cookie behavior, and related site settings. Identifies gaps and walks the user through fixes. Use when the user wants to review headers, fix CSP errors, allow embedding in another site, control cross-origin access, harden cookie settings, or asks "are my browser settings safe?", "fix my CSP", "set up CORS" — even if they only mention a specific header name without saying "security headers".
中文简介正在准备中。当前显示原文说明。
Fix OAuth PKCE "Session not found" or "No code verifier" errors in SPAs after redirect from external auth server. Use when: (1) OAuth callback fails with session/verifier not found despite flow starting correctly, (2) PKCE code_verifier stored in sessionStorage is missing after redirect back from auth server, (3) Error only happens in production or cross-origin redirects, not in local dev. Root cause: sessionStorage is lost when the browser opens a new tab, changes browsing context, or certain browsers clear it during cross-origin navigation. Fix: use localStorage instead (clean up after exchange).
中文简介正在准备中。当前显示原文说明。
CORS misconfiguration testing playbook. Use when analyzing cross-origin trust, credentialed browser reads, origin reflection, preflight policy bugs, and browser-based access to authenticated APIs.
中文简介正在准备中。当前显示原文说明。
Identify and exploit Cross-Origin Resource Sharing (CORS) misconfigurations. Use this skill when auditing APIs or web applications that share sensitive data across domains, forcing victims' browsers to inadvertently leak private information (e.g., API keys, PII, CSRF tokens) to an attacker-controlled website.
中文简介正在准备中。当前显示原文说明。
Configures Cross-Origin Resource Sharing with proper headers, preflight handling, and security best practices. Use when users request "CORS setup", "cross-origin requests", "API CORS", "preflight requests", or "CORS headers".
中文简介正在准备中。当前显示原文说明。
Review Referrer-Policy settings to limit sensitive URL details shared when visitors follow external links. Check response headers and pages containing private parameters, suggest suitable policy values, and explain how to verify the resulting browser behavior.
中文简介正在准备中。当前显示英语简介。
Verify changes to the copilot-kit-ag-ui demo by building and running its server. Check API routing, cross-origin access settings, and build configuration, then use real credentials to confirm that a requested chart appears.
中文简介正在准备中。当前显示英语简介。
Build serverless endpoints that relay external API requests for a dashboard while keeping API keys on the server. Includes Vercel examples for input checks, caching, cross-origin access, and consistent JSON responses.
中文简介正在准备中。当前显示英语简介。
Hunt CORS Misconfiguration — origin-reflection with credentials, null-origin trust, subdomain-regex bypass (unanchored vs unescaped-dot vs prefix-only), pre-flight (OPTIONS) gating bypass, postMessage origin checks. High only when an attacker-controlled origin can perform a CREDENTIALED cross-origin read of sensitive data and you have proven it in a browser. Use when testing API endpoints, SPAs, or any app emitting Access-Control-* headers.
中文简介正在准备中。当前显示原文说明。
Build Cypress test suites in TypeScript: E2E tests, component tests, custom commands, cy.intercept network control, cy.session login, Cypress Cloud, and CI integration. Covers retry-ability, the command queue, cross-origin flows with cy.origin, and data-driven testing with fixtures. Use when: "write E2E test in Cypress," "Cypress page object / custom command," "cy.," "cy.intercept," "Cypress component test," "Cypress Cloud," "cypress.config.ts." Not for: Playwright suites — use playwright-automation; flaky-test healing or quarantine — use test-reliability; bulk selector regeneration after a UI refactor — use selector-drift-recovery; Selenium-to-Cypress conversion — use test-migration. Related: playwright-automation, ci-cd-integration, visual-testing, unit-testing, test-reliability.
中文简介正在准备中。当前显示原文说明。
Configure CORS for web APIs. Use when a user asks to fix CORS errors, allow cross-origin requests, configure CORS headers, handle preflight requests, or secure API access from different domains.
中文简介正在准备中。当前显示原文说明。
CORS misconfiguration allows attacker-controlled origins to read sensitive cross-origin responses when servers echo the `Origin` header in `Access-Control-Allow-Origin` or set it to `*` with `Access-Control-Allow-Credentials: true`. Detect via `Origin: https://attacker.com` reflection in `Access-Control-Allow-Origin` response header, wildcard `*` on credentialed endpoints, and null origin acceptance. Tools: OWASP ZAP, Burp Suite, manual `fetch()` with `credentials: include`.
中文简介正在准备中。当前显示原文说明。
Generate and maintain browser demos of Pulp audio plugins (both web ABIs — WAM and WCLAP) from one declarative config, so every demo mounts the SAME shared player and the two ABIs stay in lockstep. Invoke it whenever you publish/update a browser demo of a Pulp plugin, add a plugin to a demo gallery, stand up a new gallery, or touch demo pages/hosting. It runs a deterministic generator (config → stamped WAM+WCLAP site + owned-files manifest) and a blocking validator (config schema, cross-origin-isolation coverage, OG metadata, regeneration ownership). Customization is declarative config in <repo>/.pulp-web-demo/config.json (schema bundled) plus at most two typed module seams; the shared player (pinned @danielraffel/web-player) holds all UX behavior and is never vendored. Works in Claude and Codex.
中文简介正在准备中。当前显示原文说明。
You are helping a penetration tester exploit Cross-Origin Resource Sharing
中文简介正在准备中。当前显示原文说明。
Hunt CORS Misconfiguration — origin-reflection with credentials, null-origin trust, subdomain-regex bypass (unanchored vs unescaped-dot vs prefix-only), pre-flight (OPTIONS) gating bypass, postMessage origin checks. High only when an attacker-controlled origin can perform a CREDENTIALED cross-origin read of sensitive data and you have proven it in a browser. Use when testing API endpoints, SPAs, or any app emitting Access-Control-* headers.
中文简介正在准备中。当前显示原文说明。
DOM-based attacks execute in the victim's browser — the server often never sees the payload, so WAFs and server-side input filters do not apply. PostMessage missing-origin-check = cross-origin token theft with no XSS needed.
中文简介正在准备中。当前显示原文说明。