Requests and files

Required

• Fetch only allowed addresses

  Required

  When the server fetches an address a user gave, allow only the hosts it needs. Never reach internal or cloud metadata addresses.

• Check every uploaded file

  Required

  Accept only the file types you need, check them by content, limit their size, and store them where they cannot run.

• Keep file paths inside their folder

  Required

  Never build a file path from user input without proving the result stays inside the allowed folder.

• Redirect only to your own pages

  Required

  A redirect that takes its target from the address must only go to your own pages or an allow-list.

• Share data across sites on purpose

  Required

  Allow other sites to read your API only from a fixed list of origins. Never copy the request's Origin into the reply when cookies are allowed.

• Check the origin of WebSocket connections

  Required

  Accept a WebSocket connection only from your own origins, and only after checking the user's login, as for any other request.

• Treat data from other APIs as untrusted

  Required

  Check and limit what comes back from partner and third-party APIs, as you would for user input.

• Unpack archives safely

  Required

  Keep every entry of an uploaded zip or tar file inside the target folder, and stop unpacking at a fixed total size and file count.

• Keep private pages out of shared caches

  Required

  Mark every reply that depends on the logged-in user Cache-Control: private, and never let a CDN cache by file extension alone.