Cursor rule

1> This file extends [common/security.md](../common/security.md) with web-specific security content.
2 
3# Web Security Rules
4 
5## Content Security Policy
6 
7Always configure a production CSP.
8 
9### Nonce-Based CSP
10 
11Use a per-request nonce for scripts instead of `'unsafe-inline'`.
12 
13```text
14Content-Security-Policy:
15  default-src 'self';
16  script-src 'self' 'nonce-{RANDOM}' https://cdn.jsdelivr.net;
17  style-src 'self' 'unsafe-inline' https://fonts.googleapis.com;
18  img-src 'self' data: https:;
19  font-src 'self' https://fonts.gstatic.com;
20  connect-src 'self' https://*.example.com;
21  frame-src 'none';
22  object-src 'none';
23  base-uri 'self';
24```
25 
26Adjust origins to the project. Do not cargo-cult this block unchanged.
27 
28## XSS Prevention
29 
30- Never inject unsanitized HTML
31- Avoid `innerHTML` / `dangerouslySetInnerHTML` unless sanitized first
32- Escape dynamic template values
33- Sanitize user HTML with a vetted local sanitizer when absolutely necessary
34 
35## Third-Party Scripts
36 
37- Load asynchronously
38- Use SRI when serving from a CDN
39- Audit quarterly
40- Prefer self-hosting for critical dependencies when practical
41 
42## HTTPS and Headers
43 
44```text
45Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
46X-Content-Type-Options: nosniff
47X-Frame-Options: DENY
48Referrer-Policy: strict-origin-when-cross-origin
49Permissions-Policy: camera=(), microphone=(), geolocation=()
50```
51 
52## Forms
53 
54- CSRF protection on state-changing forms
55- Rate limiting on submission endpoints
56- Validate client and server side
57- Prefer honeypots or light anti-abuse controls over heavy-handed CAPTCHA defaults
58