Individual skill
cross-origin-security
Use when reviewing scripts, client components, bundles, or runtime behavior related to Handle cross-origin requests securely. Inspect both source code and the browser execution path so fixes target the real bottleneck or bug.
skills/cross-origin-security/SKILL.md
Source commit e8d14d049010e2ce25afcd5e8609dfcbbe63e47e
What was checked
- Matches the observed repository HEAD
- Yes
- Scanner rules are current
- Yes
- Repository scan complete
- No
- Skill scan complete
- No
- Observed behavior
- Network or broad shell
- Last checked
- Nov 9, 2026
These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.
Install this skill
Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.
An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.
Repository context
- Repository stars (not skill ratings)
- 74,686
- Repository last updated
- Oct 31, 2026
- License
- MIT
Observed agent integration: No specific integration evidence. Standard SKILL.md installation does not imply verified compatibility.
- frontend Repository topic
- front-end-development Repository topic
- front-end-developer-tool Repository topic
- guidelines Repository topic
- checklist Repository topic
- reference Repository topic
- web-development Repository topic
- html Repository topic
- css Repository topic
- javascript Repository topic
- security Derived category
Files and excerpt
File metadata and permitted, redacted excerpts come from the recorded scan. Source links are pinned to that commit.
Browse files
SKILL.mdcore · 2,382 bytesSKILL.mdcore · 2,382 bytesreferences/rule.mddoc · 5,316 bytes
Read excerpt
# Handle cross-origin requests securely
The Same-Origin Policy is the browser's primary defense against malicious sites stealing data or performing actions on behalf of your users. Misconfiguring CORS or failing to validate postMessage origins can allow attackers to bypass this protection — reading private data, submitting forms as users, or injecting content into your pages.
## Quick Reference
- Always verify event.origin before processing postMessage data
- Never set Access-Control-Allow-Origin: * for authenticated endpoints
- Validate and sanitize all data received from cross-origin messages
- Use SameSite cookies to prevent CSRF from cross-origin requests
- Reject unvalidated redirect targets such as `next`, `redirect`, or `callbackUrl`
## Check
