前端应用
state-management-security
更新于 2026-10-16
State Management · 安全规则
Security rules for State Management: boundary validation, server-side authorisation and zero secret leakage.
- 技术栈
- State Management
- 主题
- 安全
- 条目
- 9 条
- 版本
- v0.2.0
✓ 应当这么做
- ✓ Validate and normalise every input at the boundary it enters the system
- ✓ Authorise on the server against the authenticated principal, never on client claims
- ✓ Keep secrets out of repositories, logs and error messages
✕ 常见反模式
- ✕ Trusting headers or parameters that a client can set freely
- ✕ Disabling TLS verification or CSRF protection to unblock a test
- ✕ Wide-scope tokens with no expiry
◎ 交付前验证
- ◎ React DevTools profiler shows no render loops after the change
- ◎ Strict Mode double-invocation does not duplicate side effects
- ◎ Server and client render output match (no hydration mismatch warnings)
同分类条目
40 篇前端应用
React 工程规则
React 19 delivery rules: pure render, server actions and stable list identity
前端应用
Next.js 工程规则
Next.js 15 App Router rules: async cookies/headers and server/client boundary discipline
前端应用
Nuxt 工程规则
Nuxt 3 rules: data fetching composables and SSR-safe state
前端应用
Vue 工程规则
Vue 3 Composition API rules: pure computed state and typed props
前端应用
Svelte 工程规则
Svelte 5 rules: runes-based reactivity and effect discipline
前端应用
Solid 工程规则
Solid.js rules: fine-grained reactivity without dependency-array leakage