Web Security taste — ChatGPT prompt: what it does, how to install
A curated set of web security conventions with confidence scores. Helps full-stack developers verify session cookies, auth flows, and injection defenses.
Open on GitHubWhat Web Security taste does
This prompt supplies a developer mindset for web security, paired with explicit confidence levels from 0.75 to 0.95. It dictates vetted authentication libraries instead of custom implementations, Argon2id or bcrypt password hashing, and session tokens stored exclusively in HttpOnly, Secure, SameSite=Lax cookies rather than localStorage.
For backend logic, the rules enforce server-side authorization checks on every request to prevent IDOR bugs, private-by-default routing, and parameterized SQL queries. Network defenses include blocking SSRF requests targeting internal IP ranges, using strict Content Security Policy headers with nonces, and isolating user file uploads on a separate domain.
CORS policies cannot reflect the request origin when credentials are sent. Escaping raw HTML in templates is treated as an immediate review flag.
What it helps with
- stop IDOR vulnerabilities across object endpoints
- configure session storage using secure HTTP cookies
- block server-side request forgery to internal IP ranges
- eliminate SQL injection through parameterized queries
- set up automated dependency audits with Renovate or Dependabot
Example prompts for the agent
- Review this user authentication endpoint against the Web Security taste guidelines
- Audit this file upload controller using the Web Security taste checklist
- Check this database query layer for SQL injection and authorization gaps
How to install Web Security taste
How to use
Paste the text at the start of a chat or into project instructions
Manually: put the files in place
.claude/commands/prompts.csv.mdQuestions about Web Security taste
How to install Web Security taste in Claude Code?
Add the prompt entry into .claude/commands/prompts.csv.md. In ChatGPT or Claude.ai, paste the prompt text directly into your conversation.
Which password hashing algorithms does Web Security taste recommend?
The prompt explicitly mandates Argon2id or bcrypt with an appropriate work factor. Writing custom password storage logic is forbidden.
How does the prompt handle session security?
Sessions must be stored in cookies with HttpOnly, Secure, and SameSite=Lax attributes instead of localStorage. The session identifier must rotate upon login and privilege changes.
Source text
prompts.csv · CC0-1.0
# Web security taste of a full-stack developer - Use the framework's auth or a vetted library; never hand-roll password storage or session handling. Confidence: 0.95 - Hash passwords with Argon2id or bcrypt and a sensible work factor. Confidence: 0.95 - Store sessions in HttpOnly, Secure, SameSite=Lax cookies rather than localStorage. Confidence: 0.90 - Rotate the session id on login and on privilege change. Confidence: 0.85 - Offer passkeys or TOTP as a second factor, and require it for admin accounts. Confidence: 0.85 - Check authorization on the server for every request, including on object ids, to stop IDOR bugs. Confidence: 0.95 - Deny by default: new routes are private until someone explicitly makes them public. Confidence: 0.85 - Use parameterized queries or an ORM everywhere; never build SQL with string concatenation. Confidence: 0.95 - Rely on the template engine's automatic escaping and treat every raw HTML escape hatch as a review flag. Confidence: 0.90 - Ship a strict Content Security Policy with nonces, starting in report-only mode. Confidence: 0.80 - Send HSTS, X-Content-Type-Options: nosniff, and frame-ancestors on every response. Confidence: 0.85 - Protect state-changing requests with SameSite cookies plus CSRF tokens or an origin check. Confidence: 0.85 - Rate-limit login, signup, password reset, and other expensive endpoints. Confidence: 0.90 - Return the same message for an unknown email and a wrong password to avoid account enumeration. Confidence: 0.80 - Validate uploads by content type and size, store them outside the web root, and serve them from a separate domain. Confidence: 0.80 - Block server-side requests to internal and metadata IP ranges to prevent SSRF. Confidence: 0.80 - Keep secrets in a secret manager or environment, never in the repo or the client bundle. Confidence: 0.95 - Run dependency audits and automated update PRs (Dependabot or Renovate) on every repository. Confidence: 0.85 - Log security events such as logins, failed logins, and permission changes, without logging credentials. Confidence: 0.85 - Configure CORS with an explicit origin allowlist; never reflect the request origin with credentials. Confidence: 0.90 - Use short-lived, narrowly scoped API tokens and make them revocable. Confidence: 0.85 - Run a quick OWASP Top 10 check in review for every feature that touches auth, input, or files. Confidence: 0.75
© f · CC0-1.0 · f/prompts.chat
