AI45Lab/OpenART

[Credential-related source omitted]

[Credential-related source omitted]

export JUDGE_BASE_URL="http://your-endpoint/v1"

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

OPENART_PLANNER_BASE_URL=https://api.example.com/v1

[Credential-related source omitted]

#!/usr/bin/env python3

[Credential-related source omitted]

Executable file

parsed = urlparse(text)     if parsed.scheme != "https" or parsed.netloc.lower() != "github.com":         raise ValueError("only https://github.com URLs are supported")

if parsed.scheme != "https" or parsed.netloc.lower() != "github.com":         raise ValueError("only https://github.com URLs are supported")     parts = [part for part in parsed.path.split("/") if part]

raise ValueError("only https://github.com URLs are supported")

[Credential-related source omitted]

encoded_path = "/".join(quote(part, safe="") for part in PurePosixPath(api_path).parts)     query = urlencode({"ref": selection.ref})     return f"https://api.github.com/repos/{quote(selection.owner, safe='')}/{quote(selection.repo, safe=''

return f"https://api.github.com/repos/{quote(selection.owner, safe='')}/{quote(selection.repo, safe='')}/contents/{encoded_path}?{query}"

return base64.b64decode(content)

Apache License Version 2.0, January 2004 http://www.apache.org/licenses/

http://www.apache.org/licenses/

http://www.apache.org/licenses/LICENSE-2.0

- For API reference, schema, parameter, or required-field questions, use `mcp__openaiDeveloperDocs__get_openapi_spec` when available to verify the API shape alongside the relevant guide or reference page. - Use `mcp__openaiDeveloperDocs__li

- Use `mcp__openaiDeveloperDocs__list_openai_docs` only when you need to browse or discover non-Codex pages without a clear query. - For model-selection, "latest model", or default-model questions, fetch `https://developers.openai.com/api/d

- For model-selection, "latest model", or default-model questions, fetch `https://developers.openai.com/api/docs/guides/latest-model.md` first. If that is unavailable, load `references/latest-model.md`.

1. Run the install command yourself: `codex mcp add openaiDeveloperDocs --url https://developers.openai.com/mcp`

2. For Codex self-knowledge requests, follow the Codex self-knowledge source procedure above. 3. For model-selection or upgrade requests, prefer current remote docs over bundled references when the user asks for latest/current/default guida

3. For model-selection or upgrade requests, prefer current remote docs over bundled references when the user asks for latest/current/default guidance.    - Fetch `https://developers.openai.com/api/docs/guides/latest-model.md`.    - Find the

- Fetch `https://developers.openai.com/api/docs/guides/latest-model.md`.

- `https://developers.openai.com/api/docs/guides/latest-model.md` -> current model-selection and "best/latest/current model" questions. - `scripts/fetch-codex-manual.mjs` -> current Codex manual fetch, verification, local temp cache, and ou

- `scripts/fetch-codex-manual.mjs` -> current Codex manual fetch, verification, local temp cache, and outline generation. - `https://developers.openai.com/codex/codex-manual.md` -> current Codex self-knowledge synthesis, including setup, cu

- `https://developers.openai.com/codex/codex-manual.md` -> current Codex self-knowledge synthesis, including setup, customization, skills, plugins, MCP, hooks, `AGENTS.md`, automations, and surface behavior; normally access it through the h

description: "OpenAI Developer Docs MCP server"       transport: "streamable_http"       url: "https://developers.openai.com/mcp"

url: "https://developers.openai.com/mcp"

<svg xmlns="http://www.w3.org/2000/svg" width="14" height="14" fill="currentColor" viewBox="0 0 14 14">

- For API reference, schema, parameter, or required-field questions, use `mcp__openaiDeveloperDocs__get_openapi_spec` when available to verify the API shape alongside the relevant guide or reference page. - Use `mcp__openaiDeveloperDocs__li

- Use `mcp__openaiDeveloperDocs__list_openai_docs` only when you need to browse or discover non-Codex pages without a clear query. - For model-selection, "latest model", or default-model questions, fetch `https://developers.openai.com/api/d

- For model-selection, "latest model", or default-model questions, fetch `https://developers.openai.com/api/docs/guides/latest-model.md` first. If that is unavailable, load `references/latest-model.md`.

1. Run the install command yourself: `codex mcp add openaiDeveloperDocs --url https://developers.openai.com/mcp`

2. For Codex self-knowledge requests, follow the Codex self-knowledge source procedure above. 3. For model-selection or upgrade requests, prefer current remote docs over bundled references when the user asks for latest/current/default guida

3. For model-selection or upgrade requests, prefer current remote docs over bundled references when the user asks for latest/current/default guidance.    - Fetch `https://developers.openai.com/api/docs/guides/latest-model.md`.    - Find the

- Fetch `https://developers.openai.com/api/docs/guides/latest-model.md`.

- `https://developers.openai.com/api/docs/guides/latest-model.md` -> current model-selection and "best/latest/current model" questions. - `scripts/fetch-codex-manual.mjs` -> current Codex manual fetch, verification, local temp cache, and ou

- `scripts/fetch-codex-manual.mjs` -> current Codex manual fetch, verification, local temp cache, and outline generation. - `https://developers.openai.com/codex/codex-manual.md` -> current Codex self-knowledge synthesis, including setup, cu

- `https://developers.openai.com/codex/codex-manual.md` -> current Codex self-knowledge synthesis, including setup, customization, skills, plugins, MCP, hooks, `AGENTS.md`, automations, and surface behavior; normally access it through the h

#!/usr/bin/env node

const DEFAULT_MANUAL_URL = "https://developers.openai.com/codex/codex-manual.md";

if (!headerBlock) {     throw new ManualFetchError("curl did not return HTTP response headers.");

throw new ManualFetchError("curl did not return HTTP response headers.");

if (!statusMatch) {     throw new ManualFetchError(       `Could not parse HTTP status from curl response: ${statusLine}`

throw new ManualFetchError(       `Could not parse HTTP status from curl response: ${statusLine}`     );

`Could not parse HTTP status from curl response: ${statusLine}`

if (lastError?.code === "ENOENT") {     throw new ManualFetchError("curl is unavailable in this environment.", {

throw new ManualFetchError("curl is unavailable in this environment.", {

return withTimeout(     (signal) =>       fetch(url, {

(signal) =>       fetch(url, {         method,

fetch(url, {

#!/usr/bin/env node

const DEFAULT_URL =   "https://developers.openai.com/api/docs/guides/latest-model.md";

"https://developers.openai.com/api/docs/guides/latest-model.md";

const DEFAULT_BASE_URL = "https://developers.openai.com";

const response = await fetch(source, {

Apache License Version 2.0, January 2004 http://www.apache.org/licenses/

http://www.apache.org/licenses/

http://www.apache.org/licenses/LICENSE-2.0

sudo apt-get install -y poppler-utils

sudo apt-get install -y poppler-utils

"$PWCLI" open https://playwright.dev --headed

"$PWCLI" open https://example.com

"$PWCLI" open https://example.com/form

"$PWCLI" open https://example.com --headed

"$PWCLI" tab-new https://example.com

"$PWCLI" open https://playwright.dev --headed

"$PWCLI" open https://example.com

"$PWCLI" open https://example.com/form

"$PWCLI" open https://example.com --headed

"$PWCLI" tab-new https://example.com

Apache License Version 2.0, January 2004 http://www.apache.org/licenses/

http://www.apache.org/licenses/

http://www.apache.org/licenses/LICENSE-2.0

<svg xmlns="http://www.w3.org/2000/svg" width="16" height="16" fill="currentColor" viewBox="0 0 16 16">

#!/usr/bin/env bash

Executable file

#!/usr/bin/env python3

b"\x89PNG\r\n\x1a\n\x00\x00\x00\rIHDR\x00\x00\x00\x01\x00\x00\x00\x01"

b"\x08\x06\x00\x00\x00\x1f\x15\xc4\x89\x00\x00\x00\x0cIDAT\x08\xd7c"

b"\xf8\xff\xff?\x00\x05\xfe\x02\xfeA\xad\x1c\x1c\x00\x00\x00\x00IEND"

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

Apache License Version 2.0, January 2004 http://www.apache.org/licenses/

http://www.apache.org/licenses/

http://www.apache.org/licenses/LICENSE-2.0

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

Required: - MUST set an overall timeout on `http.Client` usage (or equivalent per-request deadlines via context + transport timeouts). - MUST ensure `resp.Body.Close()` is called for all successful requests (typically `defer resp.Body.Close

- MUST set an overall timeout on `http.Client` usage (or equivalent per-request deadlines via context + transport timeouts). - MUST ensure `resp.Body.Close()` is called for all successful requests (typically `defer resp.Body.Close()` immedi

Detection hints: - Search for `http.Get(`, `http.Post(`, `client := &http.Client{}` without `Timeout`, `client.Do(` and missing closes.

- Search for `http.Get(`, `http.Post(`, `client := &http.Client{}` without `Timeout`, `client.Do(` and missing closes.

Notes: - The net/http package exposes `DefaultClient` as a zero-valued `http.Client`, which can easily lead to “no timeout” behavior unless configured.

- The net/http package exposes `DefaultClient` as a zero-valued `http.Client`, which can easily lead to “no timeout” behavior unless configured.

Primary Go documentation: - Go Security Policy — https://go.dev/doc/security/policy

- Go Security Policy — https://go.dev/doc/security/policy

- Go Release History (security fixes in patch releases) — https://go.dev/doc/devel/release

- Go 1.25 Release Notes — https://go.dev/doc/go1.25

- net/http (server timeouts, MaxHeaderBytes, DefaultClient) — https://pkg.go.dev/net/http

- html/template (auto-escaping and trusted-template assumptions) — https://pkg.go.dev/html/template

- crypto/tls (MinVersion defaults, InsecureSkipVerify warnings) — https://pkg.go.dev/crypto/tls

- crypto/rand (secure randomness, token helpers) — https://pkg.go.dev/crypto/rand

- crypto/subtle (constant-time comparisons) — https://pkg.go.dev/crypto/subtle

- os/exec (no shell by default; command execution guidance) — https://pkg.go.dev/os/exec

- os/exec (no shell by default; command execution guidance) — https://pkg.go.dev/os/exec

- unsafe (bypasses type safety) — https://go.dev/src/unsafe/unsafe.go

- net/http/pprof (debug endpoints) — https://pkg.go.dev/net/http/pprof

- cmd/go (module authentication via go.sum/checksum DB; env vars like GOINSECURE) — https://pkg.go.dev/cmd/go

- Module Mirror and Checksum Database Launched (Go blog) — https://go.dev/blog/module-mirror-launch

- govulncheck documentation — https://pkg.go.dev/golang.org/x/vuln/cmd/govulncheck

- Go Race Detector documentation — https://go.dev/doc/articles/race_detector

- bcrypt (password hashing) — https://pkg.go.dev/golang.org/x/crypto/bcrypt

- Go vulnerability entry example (multipart resource consumption) — https://pkg.go.dev/vuln/GO-2023-1569

OWASP Cheat Sheet Series (general web security): - Session Management — https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html

- Session Management — https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html

- CSRF Prevention — https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html

- SSRF Prevention — https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html

- XSS Prevention — https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html

- HTTP Security Response Headers — https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html

[Credential-related source omitted]

* `exec(req.query.cmd)`

* `exec(`convert ${userPath} ...`)`

* Search for `child_process`, `exec(`, `execSync(`, `spawn(`, `fork(`.

* `fetch(req.query.url)`

* Search for `fetch(`, `axios(`, `got(`, `request(`, `node-fetch` usage where URL originates from users/DB.

* Express: Production Best Practices — Security: `https://expressjs.com/en/advanced/best-practice-security.html` ([Express][1])

* Express: Behind Proxies (`trust proxy`): `https://expressjs.com/en/guide/behind-proxies.html` ([Express][2])

* Express 5.x API Reference (parsers, static, sendFile, redirect, cookies): `https://expressjs.com/en/5x/api.html` ([Express][5])

* Express: Error Handling: `https://expressjs.com/en/guide/error-handling.html` ([Express][11])

* express-session docs (cookie flags, secret rotation, fixation mitigation, MemoryStore warning): `https://expressjs.com/en/resources/middleware/session.html` ([Express][1])

* Node.js — Security Best Practices (DoS, proxy guidance, inspector risks, request smuggling notes): `https://nodejs.org/en/learn/getting-started/security-best-practices` ([Node.js][15])

* npm Docs — `npm audit`: `https://docs.npmjs.com/cli/v9/commands/npm-audit/` ([npm Docs][16])

* Session Management: `https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html` ([OWASP Cheat Sheet Series][12])

* CSRF Prevention: `https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html` ([OWASP Cheat Sheet Series][3])

* XSS Prevention: `https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html` ([OWASP Cheat Sheet Series][4])

* Input Validation: `https://cheatsheetseries.owasp.org/cheatsheets/Input_Validation_Cheat_Sheet.html` ([OWASP Cheat Sheet Series][17])

* SQL Injection Prevention: `https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html` ([OWASP Cheat Sheet Series][6])

* OS Command Injection Defense: `https://cheatsheetseries.owasp.org/cheatsheets/OS_Command_Injection_Defense_Cheat_Sheet.html` ([OWASP Cheat Sheet Series][14])

* SSRF Prevention: `https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html` ([OWASP Cheat Sheet Series][7])

* File Upload: `https://cheatsheetseries.owasp.org/cheatsheets/File_Upload_Cheat_Sheet.html` ([OWASP Cheat Sheet Series][13])

* Unvalidated Redirects: `https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html` ([OWASP Cheat Sheet Series][18])

* HTTP Headers: `https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html` ([OWASP Cheat Sheet Series][10])

* Express package version (npm): `https://www.npmjs.com/package/express`

* Express open redirect advisory (CVE): `https://nvd.nist.gov/vuln/detail/CVE-2024-29041` ([NVD][9])

[1]: https://expressjs.com/en/advanced/best-practice-security.html "Security Best Practices for Express in Production"

[2]: https://expressjs.com/en/guide/behind-proxies.html "Express behind proxies"

[3]: https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html "Cross-Site Request Forgery Prevention - OWASP Cheat Sheet Series"

[4]: https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html "Cross Site Scripting Prevention - OWASP Cheat Sheet Series"

[5]: https://expressjs.com/en/5x/api.html "Express 5.x - API Reference"

[6]: https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html "SQL Injection Prevention - OWASP Cheat Sheet Series"

[7]: https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html "Server Side Request Forgery Prevention - OWASP Cheat Sheet Series"

[8]: https://cheatsheetseries.owasp.org/cheatsheets/Nodejs_Security_Cheat_Sheet.html "Nodejs Security - OWASP Cheat Sheet Series"

[9]: https://nvd.nist.gov/vuln/detail/cve-2024-29041?utm_source=chatgpt.com "CVE-2024-29041 Detail - NVD"

[10]: https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html "HTTP Headers - OWASP Cheat Sheet Series"

[11]: https://expressjs.com/en/guide/error-handling.html "Express error handling"

[12]: https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html "Session Management - OWASP Cheat Sheet Series"

[13]: https://cheatsheetseries.owasp.org/cheatsheets/File_Upload_Cheat_Sheet.html "File Upload - OWASP Cheat Sheet Series"

[14]: https://cheatsheetseries.owasp.org/cheatsheets/OS_Command_Injection_Defense_Cheat_Sheet.html "OS Command Injection Defense - OWASP Cheat Sheet Series"

[15]: https://nodejs.org/en/learn/getting-started/security-best-practices "Node.js — Security Best Practices"

[16]: https://docs.npmjs.com/cli/v9/commands/npm-audit/ "npm-audit | npm Docs"

[17]: https://cheatsheetseries.owasp.org/cheatsheets/Input_Validation_Cheat_Sheet.html "Input Validation - OWASP Cheat Sheet Series"

[18]: https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html "Unvalidated Redirects and Forwards - OWASP Cheat Sheet Series"

* `eval()`

* `eval(userInput)`

* Search for `eval(`, `new Function`, `setTimeout("`, `setInterval("`.

* CSP that blocks `eval()`-like APIs by default, and avoid `unsafe-eval`. ([MDN Web Docs][10])

* `const ALLOWED = new Set(["https://app.example.com", "https://accounts.example.com"]);`

[Credential-related source omitted]

* Search HTML for `<script src="https://...">` and `tag manager` snippets.

* `<script src="https://cdn.example.com/lib.js"></script>` with no `integrity`.

* Search for `<script src="https://` and `<link rel="stylesheet" href="https://` without `integrity=`.

* `eval(`, `new Function`, `setTimeout("`, `setInterval("` ([MDN Web Docs][10])

* `<script src="https://...">` without `integrity=`

* W3C Content Security Policy Level 2 (HTML `<meta>` delivery restrictions; unsupported directives in meta CSP): `https://www.w3.org/TR/CSP2/` ([W3C][3])

* MDN: CSP Guide (strict CSP, nonces/hashes, `unsafe-inline`/`unsafe-eval`, eval blocking): `https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/CSP` ([MDN Web Docs][10])

* MDN: `<meta http-equiv>` (CSP via meta and warning about meta-based security headers): `https://developer.mozilla.org/en-US/docs/Web/HTML/Reference/Elements/meta/http-equiv` ([MDN Web Docs][1])

* MDN: `frame-ancestors` (and note it’s not supported in `<meta>`): `https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Content-Security-Policy/frame-ancestors` ([MDN Web Docs][18])

* OWASP: DOM Based XSS Prevention Cheat Sheet (dangerous sinks + safe patterns like `textContent`): `https://cheatsheetseries.owasp.org/cheatsheets/DOM_based_XSS_Prevention_Cheat_Sheet.html` ([OWASP Cheat Sheet Series][2])

* MDN: `innerHTML` (security considerations): `https://developer.mozilla.org/en-US/docs/Web/API/Element/innerHTML` ([MDN Web Docs][19])

* MDN: `insertAdjacentHTML` (security considerations): `https://developer.mozilla.org/en-US/docs/Web/API/Element/insertAdjacentHTML` ([MDN Web Docs][20])

* MDN: `document.write()` / `document.writeln()` (security considerations): `https://developer.mozilla.org/en-US/docs/Web/API/Document/write` and `https://developer.mozilla.org/en-US/docs/Web/API/Document/writeln` ([MDN Web Docs][13])

* MDN: `javascript:` URLs (execution on navigation; discouraged; references `window.location`): `https://developer.mozilla.org/en-US/docs/Web/URI/Reference/Schemes/javascript` ([MDN Web Docs][4])

* W3C: Trusted Types spec (DOM XSS sinks include `Element.innerHTML` and `Location.href` setters; goals and limitations): `https://www.w3.org/TR/trusted-types/` ([W3C][15])

* MDN: `require-trusted-types-for` directive: `https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Content-Security-Policy/require-trusted-types-for` ([MDN Web Docs][11])

* MDN: `trusted-types` directive: `https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Content-Security-Policy/trusted-types` ([MDN Web Docs][16])

* MDN: `window.postMessage` (security guidance: specify targetOrigin; validate origin): `https://developer.mozilla.org/en-US/docs/Web/API/Window/postMessage` ([MDN Web Docs][5])

* OWASP: HTML5 Security Cheat Sheet (Web Messaging guidance: explicit origin, strict checks, no `innerHTML`): `https://cheatsheetseries.owasp.org/cheatsheets/HTML5_Security_Cheat_Sheet.html` ([OWASP Cheat Sheet Series][6])

* OWASP: Third Party JavaScript Management Cheat Sheet (risks and mitigations including SRI/mirroring): `https://cheatsheetseries.owasp.org/cheatsheets/Third_Party_Javascript_Management_Cheat_Sheet.html` ([OWASP Cheat Sheet Series][7])

* MDN: Subresource Integrity overview: `https://developer.mozilla.org/en-US/docs/Web/Security/Defenses/Subresource_Integrity` ([MDN Web Docs][12])

* W3C: Subresource Integrity spec: `https://www.w3.org/TR/sri-2/` ([W3C][21])

* OWASP: DOM Clobbering Prevention Cheat Sheet (named property access risk; example attacks involving `location.assign` and `javascript:`): `https://cheatsheetseries.owasp.org/cheatsheets/DOM_Clobbering_Prevention_Cheat_Sheet.html` ([OWASP 

[1]: https://developer.mozilla.org/en-US/docs/Web/HTML/Reference/Elements/meta/http-equiv "https://developer.mozilla.org/en-US/docs/Web/HTML/Reference/Elements/meta/http-equiv"

[2]: https://cheatsheetseries.owasp.org/cheatsheets/DOM_based_XSS_Prevention_Cheat_Sheet.html "https://cheatsheetseries.owasp.org/cheatsheets/DOM_based_XSS_Prevention_Cheat_Sheet.html"

[3]: https://www.w3.org/TR/CSP2/ "Content Security Policy Level 2"

[4]: https://developer.mozilla.org/en-US/docs/Web/URI/Reference/Schemes/javascript "javascript: URLs - URIs | MDN"

[5]: https://developer.mozilla.org/en-US/docs/Web/API/Window/postMessage "https://developer.mozilla.org/en-US/docs/Web/API/Window/postMessage"

[6]: https://cheatsheetseries.owasp.org/cheatsheets/HTML5_Security_Cheat_Sheet.html "https://cheatsheetseries.owasp.org/cheatsheets/HTML5_Security_Cheat_Sheet.html"

[7]: https://cheatsheetseries.owasp.org/cheatsheets/Third_Party_Javascript_Management_Cheat_Sheet.html "https://cheatsheetseries.owasp.org/cheatsheets/Third_Party_Javascript_Management_Cheat_Sheet.html"

[8]: https://cheatsheetseries.owasp.org/cheatsheets/DOM_Clobbering_Prevention_Cheat_Sheet.html "https://cheatsheetseries.owasp.org/cheatsheets/DOM_Clobbering_Prevention_Cheat_Sheet.html"

[9]: https://developer.mozilla.org/en-US/docs/Web/HTML/Reference/Attributes/rel/noopener "https://developer.mozilla.org/en-US/docs/Web/HTML/Reference/Attributes/rel/noopener"

[10]: https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/CSP "https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/CSP"

[11]: https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Content-Security-Policy/require-trusted-types-for "https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Content-Security-Policy/require-trusted-types-f

[12]: https://developer.mozilla.org/en-US/docs/Web/Security/Defenses/Subresource_Integrity "https://developer.mozilla.org/en-US/docs/Web/Security/Defenses/Subresource_Integrity"

[13]: https://developer.mozilla.org/en-US/docs/Web/API/Document/write "https://developer.mozilla.org/en-US/docs/Web/API/Document/write"

[14]: https://developer.mozilla.org/en-US/docs/Web/API/Document/writeln "https://developer.mozilla.org/en-US/docs/Web/API/Document/writeln"

[15]: https://www.w3.org/TR/trusted-types/ "https://www.w3.org/TR/trusted-types/"

[16]: https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Content-Security-Policy/trusted-types "https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Content-Security-Policy/trusted-types"

[18]: https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Content-Security-Policy/frame-ancestors "https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Content-Security-Policy/frame-ancestors"

[19]: https://developer.mozilla.org/en-US/docs/Web/API/Element/innerHTML "https://developer.mozilla.org/en-US/docs/Web/API/Element/innerHTML"

[20]: https://developer.mozilla.org/en-US/docs/Web/API/Element/insertAdjacentHTML "https://developer.mozilla.org/en-US/docs/Web/API/Element/insertAdjacentHTML"

[21]: https://www.w3.org/TR/sri-2/ "https://www.w3.org/TR/sri-2/"

* `<script src="https://…/jquery.min.js"></script>` with no `integrity`.

* Without a selector in the URL, content is passed to `.html()` before scripts are removed, which can execute scripts. ([jQuery API][3]) * SHOULD prefer `fetch()`/XHR to retrieve data, then render with safe DOM creation or sanitize explicit

* SHOULD prefer `fetch()`/XHR to retrieve data, then render with safe DOM creation or sanitize explicitly.

* `fetch()` to retrieve JSON, then render via `.text()` / node construction, or

* `fetch()` to retrieve HTML, sanitize it, then inject.

* jQuery 4.0.0 release notes (Trusted Types/CSP changes; version info): `https://blog.jquery.com/2026/01/17/jquery-4-0-0/`. ([blog.jquery.com][7]) * Download jQuery (latest version info; CDN + SRI guidance): `https://jquery.com/download/`. 

* Download jQuery (latest version info; CDN + SRI guidance): `https://jquery.com/download/`. ([jquery.com][8])

* jQuery API: `.html()`: `https://api.jquery.com/html/`. ([jQuery API][21])

* jQuery API: `.text()`: `https://api.jquery.com/text/`. ([jQuery API][14])

* jQuery API: `.append()`: `https://api.jquery.com/append/`. ([jQuery API][22])

* jQuery API: `.load()` (script execution behavior): `https://api.jquery.com/load/`. ([jQuery API][3])

* jQuery API: `jQuery.parseHTML(…, keepScripts)`: `https://api.jquery.com/jQuery.parseHTML/`. ([jQuery API][2])

* jQuery API: `$.ajax()` (`jsonp: false` security note): `https://api.jquery.com/jQuery.ajax/`. ([jQuery API][5])

* jQuery API: `$.getScript()` (executes script): `https://api.jquery.com/jQuery.getScript/`. ([jQuery API][4])

* jQuery API: `jQuery.escapeSelector()`: `https://api.jquery.com/jQuery.escapeSelector/`. ([jQuery API][20])

* NVD CVE-2019-11358 (prototype pollution; jQuery < 3.4.0): `https://nvd.nist.gov/vuln/detail/CVE-2019-11358`. ([NVD][13])

* NVD CVE-2020-11022 (XSS risk in DOM manipulation methods; patched in 3.5.0): `https://nvd.nist.gov/vuln/detail/CVE-2020-11022`. ([NVD][1])

* NVD CVE-2020-11023 (XSS risk involving `<option>`; patched in 3.5.0): `https://nvd.nist.gov/vuln/detail/CVE-2020-11023`. ([NVD][23])

* GitHub Security Advisory GHSA-gxr4-xjj5-5px2 (jQuery htmlPrefilter XSS; patched in 3.5.0): `https://github.com/jquery/jquery/security/advisories/GHSA-gxr4-xjj5-5px2`. ([GitHub][16])

* XSS Prevention: `https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html`. ([OWASP Cheat Sheet Series][24])

* DOM-based XSS Prevention: `https://cheatsheetseries.owasp.org/cheatsheets/DOM_based_XSS_Prevention_Cheat_Sheet.html`. ([OWASP Cheat Sheet Series][25])

* CSRF Prevention: `https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html`. ([OWASP Cheat Sheet Series][19])

* HTTP Security Headers: `https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html`. ([OWASP Cheat Sheet Series][12])

* Content Security Policy Cheat Sheet: `https://cheatsheetseries.owasp.org/cheatsheets/Content_Security_Policy_Cheat_Sheet.html`. ([OWASP Cheat Sheet Series][9])

* MDN: Subresource Integrity (SRI): `https://developer.mozilla.org/en-US/docs/Web/Security/Defenses/Subresource_Integrity`. ([MDN Web Docs][26])

* W3C: SRI specification: `https://www.w3.org/TR/sri-2/`. ([W3C][27])

* MDN: CSP guide: `https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/CSP`. ([MDN Web Docs][28])

* MDN: `require-trusted-types-for` directive: `https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Content-Security-Policy/require-trusted-types-for`. ([MDN Web Docs][11])

* MDN: Trusted Types API: `https://developer.mozilla.org/en-US/docs/Web/API/Trusted_Types_API`. ([MDN Web Docs][29])

* W3C: Trusted Types specification: `https://www.w3.org/TR/trusted-types/`. ([W3C][10])

* MDN: `javascript:` URL scheme warning: `https://developer.mozilla.org/en-US/docs/Web/URI/Reference/Schemes/javascript`. ([MDN Web Docs][6])

* DOMPurify project documentation: `https://github.com/cure53/DOMPurify`. ([GitHub][17])

[1]: https://nvd.nist.gov/vuln/detail/cve-2020-11022?utm_source=chatgpt.com "CVE-2020-11022 Detail - NVD"

[2]: https://api.jquery.com/jQuery.parseHTML/?utm_source=chatgpt.com "jQuery.parseHTML()"

[3]: https://api.jquery.com/load/?utm_source=chatgpt.com ".load() | jQuery API Documentation"

[4]: https://api.jquery.com/jQuery.getScript/?utm_source=chatgpt.com "jQuery.getScript()"

[5]: https://api.jquery.com/jQuery.ajax/?utm_source=chatgpt.com "jQuery.ajax()"

[6]: https://developer.mozilla.org/en-US/docs/Web/URI/Reference/Schemes/javascript?utm_source=chatgpt.com "javascript: URLs - URIs - MDN Web Docs" [7]: https://blog.jquery.com/2026/01/17/jquery-4-0-0/ "jQuery 4.0.0 | Official jQuery Blog" [

[7]: https://blog.jquery.com/2026/01/17/jquery-4-0-0/ "jQuery 4.0.0 | Official jQuery Blog" [8]: https://jquery.com/download/ "Download jQuery | jQuery" [9]: https://cheatsheetseries.owasp.org/cheatsheets/Content_Security_Policy_Cheat_Sheet

[8]: https://jquery.com/download/ "Download jQuery | jQuery"

[9]: https://cheatsheetseries.owasp.org/cheatsheets/Content_Security_Policy_Cheat_Sheet.html?utm_source=chatgpt.com "Content Security Policy - OWASP Cheat Sheet Series"

[10]: https://www.w3.org/TR/trusted-types/?utm_source=chatgpt.com "Trusted Types"

[11]: https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Content-Security-Policy/require-trusted-types-for?utm_source=chatgpt.com "Content-Security-Policy: require-trusted-types-for directive"

[12]: https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html?utm_source=chatgpt.com "HTTP Security Response Headers Cheat Sheet"

[13]: https://nvd.nist.gov/vuln/detail/cve-2019-11358?utm_source=chatgpt.com "CVE-2019-11358 Detail - NVD"

[14]: https://api.jquery.com/text/?utm_source=chatgpt.com ".text() | jQuery API Documentation"

[15]: https://api.jquery.com/val/?utm_source=chatgpt.com ".val() | jQuery API Documentation"

[16]: https://github.com/jquery/jquery/security/advisories/GHSA-gxr4-xjj5-5px2 "Potential XSS vulnerability in jQuery.htmlPrefilter and related methods · Advisory · jquery/jquery · GitHub"

[17]: https://github.com/cure53/DOMPurify?utm_source=chatgpt.com "DOMPurify - a DOM-only, super-fast, uber-tolerant XSS ..."

[18]: https://developer.mozilla.org/en-US/docs/Web/API/HTML_Sanitizer_API?utm_source=chatgpt.com "HTML Sanitizer API - MDN Web Docs"

[19]: https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html?utm_source=chatgpt.com "Cross-Site Request Forgery Prevention Cheat Sheet"

[20]: https://api.jquery.com/jQuery.escapeSelector/?utm_source=chatgpt.com "jQuery.escapeSelector()"

[21]: https://api.jquery.com/html/?utm_source=chatgpt.com ".html() | jQuery API Documentation"

[22]: https://api.jquery.com/append/?utm_source=chatgpt.com ".append() | jQuery API Documentation"

[23]: https://nvd.nist.gov/vuln/detail/cve-2020-11023?utm_source=chatgpt.com "CVE-2020-11023 Detail - NVD"

[24]: https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html?utm_source=chatgpt.com "Cross Site Scripting Prevention - OWASP Cheat Sheet Series"

[25]: https://cheatsheetseries.owasp.org/cheatsheets/DOM_based_XSS_Prevention_Cheat_Sheet.html?utm_source=chatgpt.com "DOM based XSS Prevention Cheat Sheet"

[26]: https://developer.mozilla.org/en-US/docs/Web/Security/Defenses/Subresource_Integrity?utm_source=chatgpt.com "Subresource Integrity - Security - MDN Web Docs"

[27]: https://www.w3.org/TR/sri-2/?utm_source=chatgpt.com "Subresource Integrity"

[28]: https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/CSP?utm_source=chatgpt.com "Content Security Policy (CSP) - HTTP - MDN Web Docs"

[29]: https://developer.mozilla.org/en-US/docs/Web/API/Trusted_Types_API?utm_source=chatgpt.com "Trusted Types API - MDN Web Docs"

IMPORTANT: Any versions older than these minor versions are vulnerable to "react2shell" vulnerability (https://nextjs.org/blog/CVE-2025-66478):

[Credential-related source omitted]

[Credential-related source omitted]

* MUST treat any server-side `fetch()` to a user-provided URL as high-risk.

* `await fetch(req.query.url)` or `await fetch((await request.json()).url)`

* Search for `fetch(` in server code and trace where the URL comes from.

* `exec("convert " + filename)`

* `eval(req.body.code)`

* Search for `eval(`, `new Function`, `vm.`, `require(` with non-literals.

* Blindly cloning all request headers to an outbound `fetch()` call.

* Use a configured, allowlisted canonical app origin (e.g., `APP_ORIGIN=https://example.com`).

* `fetch(userProvidedUrl)` from Route Handlers / Server Actions

* Next.js Docs: Installation (system requirements / Node version) — `https://nextjs.org/docs/app/getting-started/installation`

* Next.js Docs: Route Handlers — `https://nextjs.org/docs/app/getting-started/route-handlers`

* Next.js Docs: API Routes (Pages Router) — `https://nextjs.org/docs/pages/building-your-application/routing/api-routes`

* Next.js Docs: Environment Variables — `https://nextjs.org/docs/pages/guides/environment-variables`

* Next.js Docs: Data Security — `https://nextjs.org/docs/app/guides/data-security`

* Next.js Docs: Content Security Policy — `https://nextjs.org/docs/app/guides/content-security-policy`

* Next.js Docs: Proxy — `https://nextjs.org/docs/app/getting-started/proxy`

* Next.js Docs: `serverActions.allowedOrigins` and `serverActions.bodySizeLimit` — `https://nextjs.org/docs/app/api-reference/config/next-config-js/serverActions`

* Next.js Docs: `cookies()` — `https://nextjs.org/docs/app/api-reference/functions/cookies`

* Next.js Docs: `headers()` — `https://nextjs.org/docs/app/api-reference/functions/headers`

* Next.js Docs: Self-hosting (reverse proxy guidance) — `https://nextjs.org/docs/pages/guides/self-hosting`

* Next.js Docs: Support policy (supported versions/LTS) — `https://nextjs.org/docs/support-policy`

* Next.js Blog: How to think about security in Next.js — `https://nextjs.org/blog/security-nextjs-server-components-actions`

* GitHub Security Advisory: Next.js DoS via Server Components / Server Actions (CVE-2026-23864) — `https://github.com/advisories/GHSA-fq29-rrrv-cq2m`

* Next.js Blog: Security update (example security advisory context) — `https://nextjs.org/blog/security-update`

* OWASP Cheat Sheet Series (CSRF, Session Management, XSS Prevention, SSRF Prevention, File Upload, HTTP Headers) — `https://cheatsheetseries.owasp.org/`

[1]: https://nextjs.org/docs/app/getting-started/route-handlers "Getting Started: Route Handlers | Next.js"

[2]: https://nextjs.org/docs/app/getting-started/deploying?utm_source=chatgpt.com "Getting Started: Deploying"

[3]: https://nextjs.org/docs/pages/building-your-application/routing/api-routes "Routing: API Routes | Next.js"

[4]: https://nextjs.org/docs/app/api-reference/functions/headers "Functions: headers | Next.js"

[5]: https://nextjs.org/docs/app/api-reference/config/next-config-js/serverActions "next.config.js: serverActions | Next.js"

[6]: https://nextjs.org/blog/security-nextjs-server-components-actions "How to Think About Security in Next.js | Next.js"

[7]: https://nextjs.org/docs/pages/guides/environment-variables "Guides: Environment Variables | Next.js"

[8]: https://nextjs.org/docs/pages/guides/self-hosting?utm_source=chatgpt.com "Guides: Self-Hosting"

[9]: https://nextjs.org/docs/app/api-reference/functions/cookies "Functions: cookies | Next.js"

[10]: https://nextjs.org/blog/next-16?utm_source=chatgpt.com "Next.js 16"

[11]: https://github.com/vercel/next.js/security/advisories/GHSA-9g9p-9gw9-jx7f?utm_source=chatgpt.com "Denial of Service in Image Optimizer · Advisory"

[12]: https://nextjs.org/docs/pages/guides/authentication "Guides: Authentication | Next.js"

[Credential-related source omitted]

* `<script src="https://cdn.example.com/lib/latest.js"></script>` with no integrity.

* `fetch('/api/transfer', { method: 'POST', credentials: 'include' })` with no CSRF token/header, relying only on cookies.

* `fetch(userProvidedUrl, { credentials: 'include' })`

* Search for `fetch(` / `axios(` where the first argument or `baseURL` is derived from:

* `window.addEventListener('message', (e) => { eval(e.data) })`

* `eval(`, `new Function(`, `setTimeout("`, `setInterval("`

* React 19 stable announcement — `https://react.dev/blog/2024/12/05/react-19` ([React][23])

* React DOM docs: `dangerouslySetInnerHTML` warning — `https://react.dev/reference/react-dom/components/common#dangerouslysetting-the-inner-html` ([React][12])

* React (legacy) JSX escaping statement — `https://legacy.reactjs.org/docs/introducing-jsx.html` ([React][14])

* Cross Site Scripting Prevention (framework escape hatches; React `dangerouslySetInnerHTML`; URL validation notes) — `https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html` ([OWASP Cheat Sheet Seri

* Content Security Policy — `https://cheatsheetseries.owasp.org/cheatsheets/Content_Security_Policy_Cheat_Sheet.html` ([OWASP Cheat Sheet Series][2])

* Cross-Site Request Forgery Prevention — `https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html` ([OWASP Cheat Sheet Series][6])

* HTML5 Security (Web Storage, postMessage, tabnabbing, sandboxed frames) — `https://cheatsheetseries.owasp.org/cheatsheets/HTML5_Security_Cheat_Sheet.html` ([OWASP Cheat Sheet Series][4])

* Third Party JavaScript Management — `https://cheatsheetseries.owasp.org/cheatsheets/Third_Party_Javascript_Management_Cheat_Sheet.html` ([OWASP Cheat Sheet Series][5])

* File Upload — `https://cheatsheetseries.owasp.org/cheatsheets/File_Upload_Cheat_Sheet.html` ([OWASP Cheat Sheet Series][19])

* NPM Security best practices — `https://cheatsheetseries.owasp.org/cheatsheets/NPM_Security_Cheat_Sheet.html` ([OWASP Cheat Sheet Series][22])

* Trusted Types API — `https://developer.mozilla.org/en-US/docs/Web/API/Trusted_Types_API` ([MDN Web Docs][3])

* W3C Trusted Types spec — `https://www.w3.org/TR/trusted-types/` ([W3C][15])

* Subresource Integrity — `https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity` ([MDN Web Docs][7])

* Clickjacking defenses overview — `https://developer.mozilla.org/en-US/docs/Web/Security/Attacks/Clickjacking` ([MDN Web Docs][8])

* Using Service Workers (HTTPS requirement; proxy-like behavior) — `https://developer.mozilla.org/en-US/docs/Web/API/Service_Worker_API/Using_Service_Workers` ([MDN Web Docs][10])

* Secure contexts (powerful APIs restricted to HTTPS) — `https://developer.mozilla.org/en-US/docs/Web/Security/Defenses/Secure_Contexts` ([MDN Web Docs][18])

* Link `rel` values (noopener/noreferrer) — `https://developer.mozilla.org/en-US/docs/Web/HTML/Attributes/rel` ([MDN Web Docs][17])

* Create React App env variables warning — `https://create-react-app.dev/docs/adding-custom-environment-variables/` ([create-react-app.dev][1])

* Vite env variables security notes — `https://vite.dev/guide/env-and-mode` ([vitejs][11])

* OAuth 2.0 for Browser-Based Apps (token storage discussion) — `https://datatracker.ietf.org/doc/html/draft-ietf-oauth-browser-based-apps` ([IETF Datatracker][16])

* npm audit docs — `https://docs.npmjs.com/cli/v10/commands/npm-audit/` ([npm Docs][20])

* npm ci docs — `https://docs.npmjs.com/cli/v10/commands/npm-ci/` ([npm Docs][21])

* DOMPurify — `https://github.com/cure53/DOMPurify` ([GitHub][13])

[1]: https://create-react-app.dev/docs/adding-custom-environment-variables/ "Adding Custom Environment Variables | Create React App"

[2]: https://cheatsheetseries.owasp.org/cheatsheets/Content_Security_Policy_Cheat_Sheet.html "Content Security Policy - OWASP Cheat Sheet Series"

[3]: https://developer.mozilla.org/en-US/docs/Web/API/Trusted_Types_API "Trusted Types API - Web APIs | MDN"

[4]: https://cheatsheetseries.owasp.org/cheatsheets/HTML5_Security_Cheat_Sheet.html "HTML5 Security - OWASP Cheat Sheet Series"

[5]: https://cheatsheetseries.owasp.org/cheatsheets/Third_Party_Javascript_Management_Cheat_Sheet.html "Third Party Javascript Management - OWASP Cheat Sheet Series"

[6]: https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html "Cross-Site Request Forgery Prevention - OWASP Cheat Sheet Series"

[7]: https://developer.mozilla.org/en-US/docs/Web/Security/Defenses/Subresource_Integrity "Subresource Integrity - Security | MDN"

[8]: https://developer.mozilla.org/en-US/docs/Web/Security/Attacks/Clickjacking "Clickjacking - Security | MDN"

[9]: https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html "Cross Site Scripting Prevention - OWASP Cheat Sheet Series"

[10]: https://developer.mozilla.org/en-US/docs/Web/API/Service_Worker_API/Using_Service_Workers "Using Service Workers - Web APIs | MDN"

[11]: https://vite.dev/guide/env-and-mode "Env Variables and Modes | Vite"

[12]: https://react.dev/reference/react-dom/components/common "Common components (e.g. <div>) – React"

[13]: https://github.com/cure53/DOMPurify "GitHub - cure53/DOMPurify: DOMPurify - a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMPurify works with a secure default, but offers a lot of configurability and h

[14]: https://legacy.reactjs.org/docs/introducing-jsx.html "Introducing JSX – React"

[15]: https://www.w3.org/TR/trusted-types/ "Trusted Types"

[16]: https://datatracker.ietf.org/doc/html/draft-ietf-oauth-browser-based-apps "

" [17]: https://developer.mozilla.org/en-US/docs/Web/HTML/Reference/Attributes/rel "HTML attribute: rel - HTML | MDN"

[17]: https://developer.mozilla.org/en-US/docs/Web/HTML/Reference/Attributes/rel "HTML attribute: rel - HTML | MDN"

[18]: https://developer.mozilla.org/en-US/docs/Web/Security/Defenses/Secure_Contexts "Secure contexts - Security | MDN"

[19]: https://cheatsheetseries.owasp.org/cheatsheets/File_Upload_Cheat_Sheet.html "File Upload - OWASP Cheat Sheet Series"

[20]: https://docs.npmjs.com/cli/v10/commands/npm-audit "npm-audit | npm Docs"

[21]: https://docs.npmjs.com/cli/v10/commands/npm-ci "npm-ci | npm Docs"

[22]: https://cheatsheetseries.owasp.org/cheatsheets/NPM_Security_Cheat_Sheet.html "NPM Security - OWASP Cheat Sheet Series"

[23]: https://react.dev/blog/2024/12/05/react-19 "React v19 – React"

[Credential-related source omitted]

[Credential-related source omitted]

* `fetch(url, { credentials: 'include', method: 'POST', body: ... })` with no CSRF token/header usage anywhere.

[Credential-related source omitted]

* `<script src="https://cdn.example/...">` with no `integrity`.

* Search `index.html` and server templates for `https://` script/style tags.

[Credential-related source omitted]

* Vue Docs: Security — `https://vuejs.org/guide/best-practices/security` ([Vue.js][1])

* Vue Docs: Template Syntax (security warning about in-DOM templates) — `https://vuejs.org/guide/essentials/template-syntax` ([Vue.js][13])

* Vue Docs: Production Deployment — `https://vuejs.org/guide/best-practices/production-deployment` ([Vue.js][3])

* Vue Docs: Feature Flags — `https://link.vuejs.org/feature-flags` ([Vue.js][7])

* Vite Docs: Env Variables and Modes (VITE_* exposure + security notes) — `https://vite.dev/guide/env-and-mode` ([vitejs][2])

* Vite Docs: CLI (`vite preview` not designed for production) — `https://vite.dev/guide/cli` ([vitejs][5])

* Vite Docs: Server Options (`server.host` can listen on public addresses) — `https://vite.dev/config/server-options` ([vitejs][14])

* OWASP Cheat Sheet Series: XSS Prevention — `https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html` ([Vue.js][1])

* OWASP Cheat Sheet Series: CSRF Prevention — `https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html` ([OWASP Cheat Sheet Series][9])

* OWASP Cheat Sheet Series: Authorization — `https://cheatsheetseries.owasp.org/cheatsheets/Authorization_Cheat_Sheet.html` ([OWASP Cheat Sheet Series][8])

* OWASP Cheat Sheet Series: HTTP Headers — `https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html` ([OWASP Cheat Sheet Series][4])

* HTML5 Security Cheat Sheet (referenced by Vue) — `https://html5sec.org/` ([Vue.js][1])

* MDN: `rel="noopener"` — `https://developer.mozilla.org/en-US/docs/Web/HTML/Reference/Attributes/rel/noopener` ([MDN Web Docs][12])

* MDN: Subresource Integrity — `https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity` ([MDN Web Docs][11])

* web.dev: Trusted Types — `https://web.dev/trusted-types/` ([web.dev][10])

[1]: https://vuejs.org/guide/best-practices/security "https://vuejs.org/guide/best-practices/security"

[2]: https://vite.dev/guide/env-and-mode "https://vite.dev/guide/env-and-mode"

[3]: https://vuejs.org/guide/best-practices/production-deployment "https://vuejs.org/guide/best-practices/production-deployment"

[4]: https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html "https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html"

[5]: https://vite.dev/guide/cli "https://vite.dev/guide/cli"

[6]: https://vite.dev/guide/build "https://vite.dev/guide/build"

[7]: https://vuejs.org/guide/best-practices/production-deployment?utm_source=chatgpt.com "Production Deployment"

[8]: https://cheatsheetseries.owasp.org/cheatsheets/Authorization_Cheat_Sheet.html "https://cheatsheetseries.owasp.org/cheatsheets/Authorization_Cheat_Sheet.html"

[9]: https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html "https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html"

[10]: https://web.dev/articles/trusted-types "https://web.dev/articles/trusted-types"

[11]: https://developer.mozilla.org/en-US/docs/Web/Security/Defenses/Subresource_Integrity?utm_source=chatgpt.com "Subresource Integrity - Security - MDN Web Docs"

[12]: https://developer.mozilla.org/en-US/docs/Web/HTML/Reference/Attributes/rel/noopener "https://developer.mozilla.org/en-US/docs/Web/HTML/Reference/Attributes/rel/noopener"

[13]: https://vuejs.org/guide/essentials/template-syntax "Template Syntax | Vue.js"

[14]: https://vite.dev/config/server-options "https://vite.dev/config/server-options"

[Credential-related source omitted]

[Credential-related source omitted]

- Django Downloads (current stable & supported branches): https://www.djangoproject.com/download/

- Django 6.0 Release Notes: https://docs.djangoproject.com/en/6.0/releases/6.0/

- Django: Deployment checklist (incl. check --deploy, runserver warning, HTTPS/cookies guidance): https://docs.djangoproject.com/en/6.0/howto/deployment/checklist/

- Django: Settings reference (SecurityMiddleware settings, cookies, SECRET_KEY_FALLBACKS, CSP settings): https://docs.djangoproject.com/en/6.0/ref/settings/

- Django: Security in Django (XSS/CSRF/SQLi/clickjacking/HTTPS/host header validation/uploads/CSP): https://docs.djangoproject.com/en/6.0/topics/security/

- Django: CSRF how-to (middleware, csrf_token usage, AJAX header patterns, csrf_exempt cautions): https://docs.djangoproject.com/en/6.0/howto/csrf/

- Django: Performing raw SQL queries (parameterization guidance): https://docs.djangoproject.com/en/6.0/topics/db/sql/

- Django: QuerySet API reference (extra() cautions; “do not quote placeholders” guidance): https://docs.djangoproject.com/en/6.0/ref/models/querysets/

- Django: Template built-ins (autoescape tag): https://docs.djangoproject.com/en/6.0/ref/templates/builtins/

- Django: Template language reference (turning off autoescape & risks): https://docs.djangoproject.com/en/6.0/ref/templates/language/

- Django: Utilities reference (e.g., format_html): https://docs.djangoproject.com/en/6.0/ref/utils/

- OWASP Cheat Sheet Series: Django Security Cheat Sheet: https://cheatsheetseries.owasp.org/cheatsheets/Django_Security_Cheat_Sheet.html

[1]: https://docs.djangoproject.com/en/6.0/howto/deployment/checklist/ "https://docs.djangoproject.com/en/6.0/howto/deployment/checklist/"

[2]: https://docs.djangoproject.com/en/6.0/topics/security/ "Security in Django | Django documentation | Django"

[3]: https://docs.djangoproject.com/en/6.0/ref/settings/ "Settings | Django documentation | Django"

[4]: https://docs.djangoproject.com/en/6.0/howto/csrf/ "How to use Django’s CSRF protection | Django documentation | Django"

[5]: https://docs.djangoproject.com/en/6.0/ref/templates/builtins/ "https://docs.djangoproject.com/en/6.0/ref/templates/builtins/"

[6]: https://docs.djangoproject.com/en/6.0/ref/utils/ "https://docs.djangoproject.com/en/6.0/ref/utils/"

[7]: https://docs.djangoproject.com/en/6.0/topics/db/sql/ "https://docs.djangoproject.com/en/6.0/topics/db/sql/" [8]: https://docs.djangoproject.com/en/6.0/ref/models/querysets/ "https://docs.djangoproject.com/en/6.0/ref/models/querysets/" 

[8]: https://docs.djangoproject.com/en/6.0/ref/models/querysets/ "https://docs.djangoproject.com/en/6.0/ref/models/querysets/"

[9]: https://www.djangoproject.com/download/ "Download Django | Django"

[Credential-related source omitted]

[Credential-related source omitted]

* `httpx.get(request.query_params["url"])`

[Credential-related source omitted]

* FastAPI (PyPI metadata, versioning) — `https://pypi.org/project/fastapi/` ([PyPI][1])

* FastAPI docs: Security “First Steps” (Authorization Bearer header conventions) — `https://fastapi.tiangolo.com/tutorial/security/first-steps/` ([FastAPI][11])

* FastAPI reference: Dependencies (`Depends`, `Security`) — `https://fastapi.tiangolo.com/reference/dependencies/` ([FastAPI][7])

* FastAPI reference: APIRouter (router-level dependencies) — `https://fastapi.tiangolo.com/reference/apirouter/` ([FastAPI][28])

* FastAPI docs: WebSockets — `https://fastapi.tiangolo.com/advanced/websockets/` ([FastAPI][27])

* Starlette (PyPI, general capabilities) — `https://pypi.org/project/starlette/` ([PyPI][5])

* Starlette docs: WebSockets — `https://starlette.dev/websockets/` ([Starlette][3])

* Uvicorn (PyPI metadata) — `https://pypi.org/project/uvicorn/` ([PyPI][4])

* Pydantic docs (v2.12.x) — `https://docs.pydantic.dev/latest/` ([Pydantic][29])

* OWASP Cheat Sheet Series: Session Management — `https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html` ([OWASP Cheat Sheet Series][8])

* OWASP Cheat Sheet Series: CSRF Prevention — `https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html` ([OWASP Cheat Sheet Series][2])

* OWASP Cheat Sheet Series: XSS Prevention — `https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html` ([OWASP Cheat Sheet Series][16])

* OWASP Cheat Sheet Series: Mass Assignment — `https://cheatsheetseries.owasp.org/cheatsheets/Mass_Assignment_Cheat_Sheet.html` ([OWASP Cheat Sheet Series][14])

* OWASP API Security Top 10 (2023) — `https://owasp.org/API-Security/editions/2023/en/0x11-t10/` ([OWASP Foundation][13])

* OWASP Cheat Sheet Series: SQL Injection Prevention — `https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html` ([OWASP Cheat Sheet Series][21])

* OWASP Cheat Sheet Series: OS Command Injection Defense — `https://cheatsheetseries.owasp.org/cheatsheets/OS_Command_Injection_Defense_Cheat_Sheet.html` ([OWASP Cheat Sheet Series][22])

* OWASP Cheat Sheet Series: SSRF Prevention — `https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html` ([OWASP Cheat Sheet Series][23])

* OWASP Cheat Sheet Series: File Upload — `https://cheatsheetseries.owasp.org/cheatsheets/File_Upload_Cheat_Sheet.html` ([OWASP Cheat Sheet Series][20])

* OWASP Cheat Sheet Series: Unvalidated Redirects and Forwards — `https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html` ([OWASP Cheat Sheet Series][24])

* OWASP Cheat Sheet Series: HTTP Security Response Headers — `https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html` ([OWASP Cheat Sheet Series][6])

* OWASP Cheat Sheet Series: WebSocket Security — `https://cheatsheetseries.owasp.org/cheatsheets/WebSocket_Security_Cheat_Sheet.html` ([OWASP Cheat Sheet Series][25])

* OWASP WSTG: Testing for Server-Side Template Injection — `https://owasp.org/www-project-web-security-testing-guide/v41/4-Web_Application_Security_Testing/07-Input_Validation_Testing/18-Testing_for_Server_Side_Template_Injection` ([OWASP F

* OWASP WSTG: Testing WebSockets — `https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/11-Client-side_Testing/10-Testing_WebSockets` ([OWASP Foundation][26])

* Jinja: Sandbox — `https://jinja.palletsprojects.com/en/stable/sandbox/` ([jinja.palletsprojects.com][18])

* CVE-2023-29159 (StaticFiles path traversal; fixed 0.27.0) — `https://advisories.gitlab.com/pkg/pypi/starlette/CVE-2023-29159/` ([advisories.gitlab.com][10])

* CVE-2024-47874 (multipart/form-data DoS; fixed 0.40.0) — `https://advisories.gitlab.com/pkg/pypi/starlette/CVE-2024-47874/` ([advisories.gitlab.com][9])

* CVE-2025-62727 (FileResponse Range header DoS; fixed 0.49.1) — `https://advisories.gitlab.com/pkg/pypi/starlette/CVE-2025-62727/` ([advisories.gitlab.com][19])

[1]: https://pypi.org/project/fastapi/ "https://pypi.org/project/fastapi/"

[2]: https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html "https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html"

[3]: https://starlette.dev/websockets/?utm_source=chatgpt.com "Websockets"

[4]: https://pypi.org/project/uvicorn/ "https://pypi.org/project/uvicorn/"

[5]: https://pypi.org/project/starlette/ "https://pypi.org/project/starlette/"

[6]: https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html?utm_source=chatgpt.com "HTTP Security Response Headers Cheat Sheet"

[7]: https://fastapi.tiangolo.com/reference/dependencies/?utm_source=chatgpt.com "Dependencies - Depends() and Security() - FastAPI"

[8]: https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html "https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html"

[9]: https://advisories.gitlab.com/pkg/pypi/starlette/CVE-2024-47874/ "Starlette Denial of service (DoS) via multipart/form-data | GitLab Advisory Database"

[10]: https://advisories.gitlab.com/pkg/pypi/starlette/CVE-2023-29159/ "Starlette has Path Traversal vulnerability in StaticFiles | GitLab Advisory Database"

[11]: https://fastapi.tiangolo.com/tutorial/security/first-steps/?utm_source=chatgpt.com "Security - First Steps - FastAPI"

[12]: https://fastapi.tiangolo.com/tutorial/response-model/ "https://fastapi.tiangolo.com/tutorial/response-model/"

[13]: https://owasp.org/API-Security/editions/2023/en/0x11-t10/ "https://owasp.org/API-Security/editions/2023/en/0x11-t10/"

[14]: https://cheatsheetseries.owasp.org/cheatsheets/Mass_Assignment_Cheat_Sheet.html "https://cheatsheetseries.owasp.org/cheatsheets/Mass_Assignment_Cheat_Sheet.html"

[15]: https://fastapi.tiangolo.com/tutorial/extra-models/ "https://fastapi.tiangolo.com/tutorial/extra-models/"

[16]: https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html "https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html"

[17]: https://owasp.org/www-project-web-security-testing-guide/v41/4-Web_Application_Security_Testing/07-Input_Validation_Testing/18-Testing_for_Server_Side_Template_Injection?utm_source=chatgpt.com "Testing for Server Side Template Injecti

[18]: https://jinja.palletsprojects.com/en/stable/sandbox/?utm_source=chatgpt.com "Sandbox — Jinja Documentation (3.1.x)"

[19]: https://advisories.gitlab.com/pkg/pypi/starlette/CVE-2025-62727/ "Starlette vulnerable to O(n^2) DoS via Range header merging in ``starlette.responses.FileResponse`` | GitLab Advisory Database"

[20]: https://cheatsheetseries.owasp.org/cheatsheets/File_Upload_Cheat_Sheet.html "https://cheatsheetseries.owasp.org/cheatsheets/File_Upload_Cheat_Sheet.html"

[21]: https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html "https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html"

[22]: https://cheatsheetseries.owasp.org/cheatsheets/OS_Command_Injection_Defense_Cheat_Sheet.html "https://cheatsheetseries.owasp.org/cheatsheets/OS_Command_Injection_Defense_Cheat_Sheet.html"

[23]: https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html "https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html"

[24]: https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html?utm_source=chatgpt.com "Unvalidated Redirects and Forwards Cheat Sheet"

[25]: https://cheatsheetseries.owasp.org/cheatsheets/WebSocket_Security_Cheat_Sheet.html?utm_source=chatgpt.com "WebSocket Security - OWASP Cheat Sheet Series"

[26]: https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/11-Client-side_Testing/10-Testing_WebSockets?utm_source=chatgpt.com "WSTG - Latest | OWASP Foundation"

[27]: https://fastapi.tiangolo.com/advanced/websockets/?utm_source=chatgpt.com "WebSockets - FastAPI"

[28]: https://fastapi.tiangolo.com/reference/apirouter/?utm_source=chatgpt.com "APIRouter class - FastAPI"

[29]: https://docs.pydantic.dev/latest/ "https://docs.pydantic.dev/latest/"

Insecure patterns: - `requests.get(request.args["url"])`

- `requests.get(request.args["url"])`

Primary framework documentation: - Flask Docs: Deploying to Production — https://flask.palletsprojects.com/en/stable/deploying/

- Flask Docs: Deploying to Production — https://flask.palletsprojects.com/en/stable/deploying/

- Flask Docs: Debugging Application Errors — https://flask.palletsprojects.com/en/stable/debugging/

- Flask Docs: Configuration Handling — https://flask.palletsprojects.com/en/stable/config/

- Flask Docs: Security Considerations — https://flask.palletsprojects.com/en/stable/web-security/

- Flask Docs: Tell Flask it is Behind a Proxy — https://flask.palletsprojects.com/en/stable/deploying/proxy_fix/

- Flask API Docs: Sessions — https://flask.palletsprojects.com/en/stable/api/#sessions

Werkzeug documentation & advisories: - Werkzeug Docs: Utilities (send_file / send_from_directory / safe_join / secure_filename / password hashing) — https://werkzeug.palletsprojects.com/en/stable/utils/

- Werkzeug Docs: Utilities (send_file / send_from_directory / safe_join / secure_filename / password hashing) — https://werkzeug.palletsprojects.com/en/stable/utils/

- GitHub Advisory: CVE-2025-66221 (Werkzeug safe_join Windows device names) — https://github.com/advisories/GHSA-hgf8-39gv-g3f2

OWASP Cheat Sheet Series: - Session Management — https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html

- Session Management — https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html

- CSRF Prevention — https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html

- XSS Prevention — https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html

- Input Validation — https://cheatsheetseries.owasp.org/cheatsheets/Input_Validation_Cheat_Sheet.html

- SQL Injection Prevention — https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html

- Injection Prevention — https://cheatsheetseries.owasp.org/cheatsheets/Injection_Prevention_Cheat_Sheet.html

- OS Command Injection Defense — https://cheatsheetseries.owasp.org/cheatsheets/OS_Command_Injection_Defense_Cheat_Sheet.html

- SSRF Prevention — https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html

- File Upload — https://cheatsheetseries.owasp.org/cheatsheets/File_Upload_Cheat_Sheet.html

- Unvalidated Redirects — https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html

- HTTP Headers — https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html

Template safety references: - Jinja: Sandbox (rendering untrusted templates) — https://jinja.palletsprojects.com/en/stable/sandbox/

- Jinja: Sandbox (rendering untrusted templates) — https://jinja.palletsprojects.com/en/stable/sandbox/

- OWASP WSTG: Testing for Server-Side Template Injection — https://owasp.org/www-project-web-security-testing-guide/v41/4-Web_Application_Security_Testing/07-Input_Validation_Testing/18-Testing_for_Server_Side_Template_Injection

- PortSwigger Web Security Academy: Server-side template injection — https://portswigger.net/web-security/server-side-template-injection

HTTP semantics: - RFC 9110: HTTP Semantics (safe methods) — https://www.rfc-editor.org/rfc/rfc9110

- RFC 9110: HTTP Semantics (safe methods) — https://www.rfc-editor.org/rfc/rfc9110

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

"discovery": "https://keycloak.example.com/realms/my/.well-known/openid-configuration",

"bearer_only": true,     "introspection_endpoint": "https://keycloak.example.com/realms/my/protocol/openid-connect/token/introspect"   }

"introspection_endpoint": "https://keycloak.example.com/realms/my/protocol/openid-connect/token/introspect"

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

"discovery": "https://keycloak.example.com/realms/my/.well-known/openid-configuration",

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

"discovery": "https://keycloak.example.com/realms/my/.well-known/openid-configuration",

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

"discovery": "https://keycloak.example.com/realms/myrealm/.well-known/openid-configuration",

"scope": "openid email profile",       "redirect_uri": "http://127.0.0.1:9080/app/redirect",       "session": {

"redirect_uri": "http://127.0.0.1:9080/app/redirect",

1. User visits `http://127.0.0.1:9080/app/dashboard` → no session

2. APISIX redirects to Keycloak login page 3. User authenticates → Keycloak redirects to `http://127.0.0.1:9080/app/redirect?code=...` 4. APISIX exchanges code for tokens, stores in session cookie

3. User authenticates → Keycloak redirects to `http://127.0.0.1:9080/app/redirect?code=...` 4. APISIX exchanges code for tokens, stores in session cookie 5. Subsequent requests use the session cookie automatically

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

"discovery": "https://keycloak.example.com/realms/myrealm/.well-known/openid-configuration",

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

"https://keycloak.example.com/realms/myrealm/protocol/openid-connect/token" \

[Credential-related source omitted]

[Credential-related source omitted]

# Call the API curl -i http://127.0.0.1:9080/api/resource \

curl -i http://127.0.0.1:9080/api/resource \

| Provider | Discovery URL Pattern | |----------|----------------------| | **Keycloak** | `https://{host}/realms/{realm}/.well-known/openid-configuration` |

|----------|----------------------| | **Keycloak** | `https://{host}/realms/{realm}/.well-known/openid-configuration` | | **Auth0** | `https://{tenant}.auth0.com/.well-known/openid-configuration` |

| **Keycloak** | `https://{host}/realms/{realm}/.well-known/openid-configuration` |

| **Auth0** | `https://{tenant}.auth0.com/.well-known/openid-configuration` |

| **Okta** | `https://{org}.okta.com/.well-known/openid-configuration` |

| **Azure AD** | `https://login.microsoftonline.com/{tenant}/v2.0/.well-known/openid-configuration` |

| **Google** | `https://accounts.google.com/.well-known/openid-configuration` |

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

"discovery": "https://idp.example.com/.well-known/openid-configuration",

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

"discovery": "https://idp.example.com/.well-known/openid-configuration",

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

"discovery": "https://idp.example.com/.well-known/openid-configuration",

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

discovery: https://keycloak.example.com/realms/myrealm/.well-known/openid-configuration

scope: openid email profile         redirect_uri: http://127.0.0.1:9080/app/redirect         session:

redirect_uri: http://127.0.0.1:9080/app/redirect

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

"discovery": "https://keycloak.example.com/realms/my/.well-known/openid-configuration",

"bearer_only": true,     "introspection_endpoint": "https://keycloak.example.com/realms/my/protocol/openid-connect/token/introspect"   }

"introspection_endpoint": "https://keycloak.example.com/realms/my/protocol/openid-connect/token/introspect"

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

"discovery": "https://keycloak.example.com/realms/my/.well-known/openid-configuration",

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

"discovery": "https://keycloak.example.com/realms/my/.well-known/openid-configuration",

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

"discovery": "https://keycloak.example.com/realms/myrealm/.well-known/openid-configuration",

"scope": "openid email profile",       "redirect_uri": "http://127.0.0.1:9080/app/redirect",       "session": {

"redirect_uri": "http://127.0.0.1:9080/app/redirect",

1. User visits `http://127.0.0.1:9080/app/dashboard` → no session

2. APISIX redirects to Keycloak login page 3. User authenticates → Keycloak redirects to `http://127.0.0.1:9080/app/redirect?code=...` 4. APISIX exchanges code for tokens, stores in session cookie

3. User authenticates → Keycloak redirects to `http://127.0.0.1:9080/app/redirect?code=...` 4. APISIX exchanges code for tokens, stores in session cookie 5. Subsequent requests use the session cookie automatically

[Credential-related source omitted]

[Credential-related source omitted]