安全与权限
jwt-session-security
更新于 2026-07-19
JWT & Sessions · 安全规则
Security rules for JWT & Sessions: boundary validation, server-side authorisation and zero secret leakage.
- 技术栈
- JWT & Sessions
- 主题
- 安全
- 条目
- 9 条
- 版本
- v0.2.0
✓ 应当这么做
- ✓ Validate and normalise every input at the boundary it enters the system
- ✓ Authorise on the server against the authenticated principal, never on client claims
- ✓ Keep secrets out of repositories, logs and error messages
✕ 常见反模式
- ✕ Trusting headers or parameters that a client can set freely
- ✕ Disabling TLS verification or CSRF protection to unblock a test
- ✕ Wide-scope tokens with no expiry
◎ 交付前验证
- ◎ Injection cases added to the adversarial test corpus
- ◎ Tool allow-lists reviewed; new tools default to deny
- ◎ Secrets scanned in output before responding
同分类条目
6 篇安全与权限
RBAC Authorisation 工程规则
Authorisation rules: server-side checks on every route and deny-by-default resources
安全与权限
JWT & Sessions 工程规则
Token rules: short-lived access tokens, rotating refresh and revocation lists
安全与权限
Secrets Management 工程规则
Secret rules: runtime injection, rotation ownership and zero plaintext in git
安全与权限
Prompt Injection Defense 工程规则
Injection defence rules: delimiter isolation and tool-output sanitisation