Jeden Skill in Manus ausführen
mit einem Klick

Jeden Skill in Manus mit einem Klick ausführen

Loslegen

security-headers-csp

Sterne2

Forks1

Aktualisiert23. Januar 2026 um 19:25

Best practices for HSTS, CORS, CSP, and security headers.

Installation

Mit Codex oder Claude installieren Kopieren Sie diesen Prompt, fügen Sie ihn in Codex, Claude oder einen anderen Assistant ein und lassen Sie die Skill-Seite prüfen und installieren.

In Manus ausführen

Quelle

sraloff

sraloff/gravityboots

GitHub-Repository öffnen Creator-Repositorys ansehen

Download

In Manus ausführen

Verwandte BerufeSOC

Basierend auf der SOC-Berufsklassifikation

InformationssicherheitsanalystenInformatik- und Mathematikberufe·SOC 15-1212

SKILL.md

readonly

name	security-headers-csp
description	Best practices for HSTS, CORS, CSP, and security headers.

Security Headers & CSP

When to use this skill

Configuring web servers (Nginx, Caddy, Apache).
Setting up middleware (Laravel, Express, Django).
Auditing site security.

1. Essential Headers

HSTS: Strict-Transport-Security: max-age=31536000 (1 year).
No Sniff: X-Content-Type-Options: nosniff.
Frame Options: X-Frame-Options: DENY or SAMEORIGIN.

2. Content Security Policy (CSP)

Default: Start with default-src 'self'.
Scripts: Avoid 'unsafe-inline' or 'unsafe-eval'. Use nonces or hashes if inline scripts are necessary.
Reporting: Use report-uri or report-to to monitor violations without breaking the site initially (Content-Security-Policy-Report-Only).

3. CORS

Scope: Only enable CORS if you are serving an API consumed by browsers on different domains.
Origin: Whitelist specific origins; avoid Access-Control-Allow-Origin: * with credentials.

Mehr aus diesem Repository

gleiches Repository

project-initialization-bootstrap

sraloff/gravityboots

Bootstraps a new project with standard folder structure, git init, basic files, planning doc skeletons, and initial memory.json. Triggers on new project creation keywords. CRITICAL for first-time setup.

2026-01-232

apache-lamp-config

sraloff/gravityboots

Configuration for Virtual Hosts, .htaccess, and PHP-FPM in LAMP stacks.

2026-01-232

api-design-patterns

sraloff/gravityboots

Principles for REST, GraphQL, versioning, and API authentication.

2026-01-232

assets-icons-fonts

sraloff/gravityboots

Optimization and usage of SVGs, fonts, and static assets.

2026-01-232

bootstrap-legacy

sraloff/gravityboots

Patterns for maintaining or migrating Bootstrap 3/4/5 projects.

2026-01-232

caddy-modern-config

sraloff/gravityboots

Caddyfile configuration, auto-HTTPS, and FastCGI.

2026-01-232

name	security-headers-csp
description	Best practices for HSTS, CORS, CSP, and security headers.

Security Headers & CSP

When to use this skill

Configuring web servers (Nginx, Caddy, Apache).
Setting up middleware (Laravel, Express, Django).
Auditing site security.

1. Essential Headers

HSTS: Strict-Transport-Security: max-age=31536000 (1 year).
No Sniff: X-Content-Type-Options: nosniff.
Frame Options: X-Frame-Options: DENY or SAMEORIGIN.

2. Content Security Policy (CSP)

Default: Start with default-src 'self'.
Scripts: Avoid 'unsafe-inline' or 'unsafe-eval'. Use nonces or hashes if inline scripts are necessary.
Reporting: Use report-uri or report-to to monitor violations without breaking the site initially (Content-Security-Policy-Report-Only).

3. CORS

Scope: Only enable CORS if you are serving an API consumed by browsers on different domains.
Origin: Whitelist specific origins; avoid Access-Control-Allow-Origin: * with credentials.