252 个 · 按相关度排序
Configure OAuth, the authorization flow used for provider sign-in, with portless development URLs. It guides callback registration and authentication library settings, helping diagnose rejected domains, redirect URL mismatches, and callbacks that point to the wrong address.
中文简介正在准备中。当前显示英语简介。
Find open redirects, where a website sends visitors to an externally controlled address. Check URL parameters and browser scripts, confirm actual navigation, and investigate whether the redirect can expose OAuth authorization codes or enable server-side access to internal services.
中文简介正在准备中。当前显示英语简介。
Audit website redirects after URL migrations, domain changes, or CMS upgrades. Record each redirect path and HTTP status code, identify unnecessary steps or loops, and update redirects to point directly to the final destination.
中文简介正在准备中。当前显示英语简介。
Audit JavaScript page redirects, confirm their impact on loading time with performance measurements, and identify where server-side 301 or 302 redirects can replace them. Get specific findings and an explanation of loading and search indexing concerns.
中文简介正在准备中。当前显示英语简介。
Audit internal links after URL migrations, domain changes, or site rebuilds. Trace redirects, record source pages and final destinations, and guide link updates so visitors and search crawlers reach the destination without extra redirect requests.
中文简介正在准备中。当前显示英语简介。
Domain routing and boundary guidance for authorized open redirect testing, including parameter redirects, meta or JavaScript redirects, and OAuth redirect_uri abuse. Use when a task belongs to the open redirect domain and needs scope, evidence, pivot, or exit criteria.
中文简介正在准备中。当前显示原文说明。
Check HTML for meta refresh redirects that can interrupt reading and confuse users. Suggest server-side redirects or clear links users choose themselves, with guidance for checking the resulting behavior using accessibility tools or assistive technology.
中文简介正在准备中。当前显示英语简介。
Check that HTTP requests redirect to HTTPS with a permanent 301 response while preserving the page path and query parameters. Review server or CDN settings, verify response headers, and explain how HSTS helps returning visitors avoid HTTP requests.
中文简介正在准备中。当前显示英语简介。
Identify Open Redirect vulnerabilities where applications route users to arbitrary external URLs based on unvalidated input. Prove maximum impact by chaining Open Redirects with OAuth token theft, SSRF, or Phishing, graduating this typically low-risk finding into a high-severity report.
中文简介正在准备中。当前显示原文说明。
Trace OAuth and OIDC sign-in flows in a CTF sandbox, from redirects through token exchange to application acceptance. Show where tokens become a recognized identity or permission, and preserve the smallest reproducible flow.
中文简介正在准备中。当前显示英语简介。
Build intermediary servers for authorized security exercises, separating public traffic from the command server used by the test team. It covers simple forwarding, request filtering with nginx or Apache, TLS certificates, and validation against the exercise’s traffic profile.
中文简介正在准备中。当前显示英语简介。
Investigate security flaws in OAuth login flows, including weak redirect checks, leaked access tokens, and skipped authentication steps. The skill guides testing of web and mobile integrations and helps document demonstrated impact and reproducible findings.
中文简介正在准备中。当前显示英语简介。
Assess account takeover risks across password resets, email changes, JWT tokens, SSO, and recovery flows. The skill connects individual weaknesses into testable scenarios and requires proof that an attacker session can gain access to a separate test account.
中文简介正在准备中。当前显示英语简介。
Fix OAuth PKCE "Session not found" or "No code verifier" errors in SPAs after redirect from external auth server. Use when: (1) OAuth callback fails with session/verifier not found despite flow starting correctly, (2) PKCE code_verifier stored in sessionStorage is missing after redirect back from auth server, (3) Error only happens in production or cross-origin redirects, not in local dev. Root cause: sessionStorage is lost when the browser opens a new tab, changes browsing context, or certain browsers clear it during cross-origin navigation. Fix: use localStorage instead (clean up after exchange).
中文简介正在准备中。当前显示原文说明。
Route protection with beforeLoad, redirect()/throw redirect(), isRedirect helper, authenticated layout routes (_authenticated), non-redirect auth (inline login), RBAC with roles and permissions, auth provider integration (Auth0, Clerk, Supabase), router context for auth state.
中文简介正在准备中。当前显示原文说明。
在授权渗透测试中挖掘开放重定向（open redirect）及其危害升级。当目标按用户可控参数做跳转（登录后 next、SSO returnUrl、注销、短链、回调）时使用——典型场景：绕过 URL 白名单跳到外站钓鱼、泄露 token/Referer、开放重定向作为 SSRF/OAuth token 窃取的跳板。适用目标类型 Web / REST API / SSO。触发场景包括用户说"测下开放重定向""这个 next/redirect 参数能跳外站吗""绕过重定向白名单""open redirect 偷 token"。输出：可跳外站的参数 + PoC + 危害升级的 finding（含 killed 记录）。
中文简介正在准备中。当前显示原文说明。
Configure Netlify projects via netlify.toml and the _headers/_redirects files — covering build settings and deploy contexts alongside environment variables/scopes and the Secrets Controller plus redirect/rewrite/proxy and custom-header rules. Use when setting a build command or publish directory, adding redirect or rewrite or proxy rules, configuring custom headers or basic auth, setting or scoping environment variables and secrets, wiring up a monorepo or SPA fallback, or skipping unnecessary builds. Reach for this whenever you touch netlify.toml or ask "why is my env var undefined in a function" or "how do I redirect this path".
中文简介正在准备中。当前显示原文说明。
Hunt Open Redirect — all types including low-impact, chained to OAuth token theft → ATO, phishing chains. URL parameter manipulation, JavaScript redirect, meta refresh, header injection. Use when hunting redirect bugs or building ATO chains.
中文简介正在准备中。当前显示原文说明。
Audit URL word separators and generate hyphenated slugs, the readable parts of page addresses. Plan changes from underscores or spaces, including permanent redirects, internal link updates, and sitemap changes.
中文简介正在准备中。当前显示英语简介。
Audit canonical URLs, which tell search engines the preferred page address, for redirects. The skill checks rendered HTML and HTTP responses, identifies affected routes or templates, and guides updates that point directly to the final URL returning 200 OK.
中文简介正在准备中。当前显示英语简介。
Access and test protected Vercel deployments with agent-browser using an existing Vercel identity and a short-lived authentication token. Keep deployment protection enabled while diagnosing login redirects, environment access mismatches, and application authentication errors.
中文简介正在准备中。当前显示英语简介。
Create, edit, and reorganize Mastra documentation with guidance matched to the page type. Find the relevant rules for writing, links, navigation, shared components, diagrams, and redirects when reviewing pages or changing their structure.
中文简介正在准备中。当前显示英语简介。
Open redirect playbook. Use when URL parameters, form actions, or JavaScript sinks control navigation targets and may redirect users to attacker-controlled destinations.
中文简介正在准备中。当前显示原文说明。
When the user wants to plan or execute a rebrand—domain change, 301 redirects, migration, or announcement. Also use when the user mentions "rebranding," "rebrand," "domain change," "domain migration," "301 redirect," "change domain name," "rebrand announcement," "social media rebrand," "brand launch," or "domain redirect." For domain choice, use domain-selection.
中文简介正在准备中。当前显示原文说明。