从代码和浏览器行为检查跨站通信，发现并修复 CORS 权限过宽、消息来源验证缺失及不安全跳转等问题，同时整理修复后的浏览器验证事项。
Use when reviewing scripts, client components, bundles, or runtime behavior related to Handle cross-origin requests securely. Inspect both source code and the browser execution path so fixes target the real bottleneck or bug.
检查跨站通信相关代码和浏览器中的实际行为，发现并修复安全问题。检查内容包括控制其他网站访问权限的 CORS 配置、postMessage 接收消息时的来源核验，以及接收数据的验证。还会检查需身份验证的通信是否获得了过于宽泛的访问许可，以及跳转逻辑是否允许前往任意外部网址。
适合审查与外部网站的集成功能，以及登录、退出登录和 SSO 流程。需要定位有问题的事件处理程序或配置，并整理修复后应在浏览器中验证哪些行为时，也可以使用。
postMessage 的消息来源与接收数据验证。”callbackUrl 是否接受任意外部网址。”对于需要身份验证的端点，采用不使用 Access-Control-Allow-Origin: * 的方针。还会检查 SameSite Cookie 等措施，以防范可能使浏览器发送非预期请求的 CSRF，即跨站请求伪造。
本介绍由 AI（OpenAI Codex）根据公开的 SKILL.md 撰写。准确的规格请查看下方原文。
AI 仅根据 SKILL.md 的内容，从 4 个方面进行了评估。星标数和热度不计入评估。
总分按每项 A=25 分、B=15 分、C=5 分相加。 由 AI（OpenAI Codex）于 2026年10月23日 评估。仅供参考，安装前请同时查看原文。
安装前可以查看交给 AI 代理的指令内容。
The Same-Origin Policy is the browser's primary defense against malicious sites stealing data or performing actions on behalf of your users. Misconfiguring CORS or failing to validate postMessage origins can allow attackers to bypass this protection — reading private data, submitting forms as users, or injecting content into your pages.
next, redirect, or callbackUrlCheck this code for insecure cross-origin patterns: missing origin validation in postMessage listeners, overly permissive CORS settings, and missing CSRF protections. Flag redirect parameters that accept arbitrary external URLs.
Add origin validation to postMessage listeners and review CORS configuration to ensure it's not overly permissive for authenticated routes. Reject or allow-list untrusted redirect destinations before navigating.
Explain the Same-Origin Policy, how CORS works, and how to securely use postMessage for cross-origin communication.
Review scripts, client components, and browser execution paths related to Handle cross-origin requests securely. Flag exact imports, event handlers, runtime side effects, or blocking operations that violate the rule, and state how the change should be verified in the browser. Check login, logout, SSO, and return-to flows for open redirects.
For full implementation details, code examples, and framework-specific guidance,
see references/rule.md.
Rule page: https://frontendchecklist.io/rules/javascript/cross-origin-security
还没有评价。欢迎分享你的使用感受。
无需登录即可发表。欢迎分享使用感受、提问，或说明在哪些环境下无法运行。
还没有评论。来写第一条吧。
Create and review custom 404 pages that help visitors recover from broken or moved links through search and navigation. Check the rendered page and HTTP response so missing content returns a proper 404 status.
中文简介正在准备中。当前显示英语简介。
Audit or create a dedicated About page that explains a website’s purpose and identifies its people or organization. Review the rendered output and supporting information, including expertise and contact details, to find gaps.
中文简介正在准备中。当前显示英语简介。
为页面和共用组件添加自动无障碍测试，检查现有测试的覆盖缺口，并将检查接入持续集成流程，以发现结构、属性问题及修改引入的新问题。
检查从登录、多因素认证到账户恢复的完整流程，找出禁止粘贴、验证码必须手动输入等使用障碍，并协助改进认证方式。
Review form errors, success messages, and live updates so screen reader users receive important notifications. Check the HTML delivered to the browser, announcement settings, display duration, and dismissal controls, then identify specific elements that need changes.
中文简介正在准备中。当前显示英语简介。
Review HTML tables so screen reader users can understand how headers and data relate. Check header markup, table descriptions, and merged cells, then identify specific fixes and ways to verify them.
中文简介正在准备中。当前显示英语简介。