mirror of
https://github.com/affaan-m/ECC.git
synced 2026-08-20 06:25:43 +02:00
sutazcaandGitHub
e05a201258
Every other language pack (typescript, react, python, golang, vue, ...) scopes its rules with a paths: YAML frontmatter block, so Claude Code only loads them when matching files are in context. The 7 files in rules/web/ ship without frontmatter, and per the official rules-loading docs (https://code.claude.com/docs/en/memory) rules without a paths field load unconditionally into every session - ~15.5KB of always-on context even in projects with no frontend code. Add the same frontmatter convention used by the react pack, scoped to web-facing file types (css/scss/sass/less/html/tsx/jsx/vue/svelte).
70 lines
1.7 KiB
Markdown
70 lines
1.7 KiB
Markdown
---
|
|
paths:
|
|
- "**/*.css"
|
|
- "**/*.scss"
|
|
- "**/*.sass"
|
|
- "**/*.less"
|
|
- "**/*.html"
|
|
- "**/*.tsx"
|
|
- "**/*.jsx"
|
|
- "**/*.vue"
|
|
- "**/*.svelte"
|
|
---
|
|
> This file extends [common/security.md](../common/security.md) with web-specific security content.
|
|
|
|
# Web Security Rules
|
|
|
|
## Content Security Policy
|
|
|
|
Always configure a production CSP.
|
|
|
|
### Nonce-Based CSP
|
|
|
|
Use a per-request nonce for scripts instead of `'unsafe-inline'`.
|
|
|
|
```text
|
|
Content-Security-Policy:
|
|
default-src 'self';
|
|
script-src 'self' 'nonce-{RANDOM}' https://cdn.jsdelivr.net;
|
|
style-src 'self' 'unsafe-inline' https://fonts.googleapis.com;
|
|
img-src 'self' data: https:;
|
|
font-src 'self' https://fonts.gstatic.com;
|
|
connect-src 'self' https://*.example.com;
|
|
frame-src 'none';
|
|
object-src 'none';
|
|
base-uri 'self';
|
|
```
|
|
|
|
Adjust origins to the project. Do not cargo-cult this block unchanged.
|
|
|
|
## XSS Prevention
|
|
|
|
- Never inject unsanitized HTML
|
|
- Avoid `innerHTML` / `dangerouslySetInnerHTML` unless sanitized first
|
|
- Escape dynamic template values
|
|
- Sanitize user HTML with a vetted local sanitizer when absolutely necessary
|
|
|
|
## Third-Party Scripts
|
|
|
|
- Load asynchronously
|
|
- Use SRI when serving from a CDN
|
|
- Audit quarterly
|
|
- Prefer self-hosting for critical dependencies when practical
|
|
|
|
## HTTPS and Headers
|
|
|
|
```text
|
|
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
|
|
X-Content-Type-Options: nosniff
|
|
X-Frame-Options: DENY
|
|
Referrer-Policy: strict-origin-when-cross-origin
|
|
Permissions-Policy: camera=(), microphone=(), geolocation=()
|
|
```
|
|
|
|
## Forms
|
|
|
|
- CSRF protection on state-changing forms
|
|
- Rate limiting on submission endpoints
|
|
- Validate client and server side
|
|
- Prefer honeypots or light anti-abuse controls over heavy-handed CAPTCHA defaults
|