manage-headers

检查并配置 Power Pages 站点安全响应头，定位风险并指导修复设置。

来源

GitHub

更新于

2026-06-07

// 安全评估低风险

仅提示词，不执行代码
开源可审计

正在进行安全审计…

凭证密钥
网络外发
代码执行
数据访问
来源供应链

// 安装

复制安装指令，让 AI 自动完成配置 · 推荐新手

请帮我安装 askskill 上的 "manage-headers" 技能：
1. 下载 https://raw.githubusercontent.com/microsoft/power-platform-skills/main/plugins/power-pages/skills/manage-headers/SKILL.md
2. 保存为 ~/.claude/skills/manage-headers/SKILL.md
3. 装好后重载技能，告诉我可以用了

// 下载

下载 SKILL.md机读安装清单 ↗

// 用法示例

修复 CSP 报错

输入

请帮我检查 Power Pages 站点的 Content Security Policy 配置。当前浏览器控制台提示某些脚本和图片被拦截，请找出缺失或过严的策略，并给出可执行的修复步骤。

预期产出

指出 CSP 配置问题、受影响资源、推荐策略调整方案及具体修复步骤。

允许站点被嵌入

输入

我想把 Power Pages 页面嵌入到另一个站点中，请检查当前的 frame 相关安全头和点击劫持防护设置，说明为什么无法嵌入，并告诉我如何安全地允许特定来源嵌入。

预期产出

说明阻止嵌入的头部配置，给出安全放行特定来源的建议与设置步骤。

配置跨域与 Cookie 安全

输入

请审查我的 Power Pages 站点的 CORS 和 Cookie 安全设置。我需要允许指定前端域名跨域访问部分资源，同时确保 Cookie 的 SameSite、Secure 等设置足够安全。

预期产出

给出跨域访问风险评估、允许清单建议，以及 Cookie 安全加固方案。

// 文档

Plugin check: Run node "${CLAUDE_PLUGIN_ROOT}/scripts/check-version.js" — if it outputs a message, show it to the user before proceeding.

Manage Headers

Inspect and configure the HTTP security headers for a Power Pages site. Headers are configured as HTTP/* site settings stored in .powerpages-site/site-settings/ YAML files.

Initial request: $ARGUMENTS

Gotchas

Site settings are YAML files. Each header is a separate .yml file in .powerpages-site/site-settings/. The file name uses - instead of / (e.g., HTTP/X-Frame-Options → http-x-frame-options.sitesetting.yml).
Absent = no header. When a site setting is absent, the runtime omits that header entirely (except CSP on new sites — see headers-reference.md).
HSTS and Cache-Control are platform-managed. Do not try to set HTTP/Strict-Transport-Security — the runtime does not recognize it and the setting has no effect.
Maker-mode bypasses headers. Requests from Power Pages Studio skip all HTTP/* header emission. Verify headers in an incognito tab, not the studio preview.
CSP is pass-through. The runtime emits the value verbatim — it does NOT merge runtime sources automatically. The CSP MUST include Power Pages runtime hosts or the site breaks.
CSP nonce. When script-src contains 'nonce', the runtime replaces it per-request with 'nonce-<random>' and auto-hashes inline event handlers. Scripts created dynamically via document.createElement do NOT receive the nonce.
SameSite=None requires HTTPS. The runtime sets Secure on every cookie over HTTPS automatically.
CORS * is auto-specialized. The runtime replaces * per-request with the specific requesting Origin — the browser sees a single-origin header, not a wildcard.

Workflow

Prerequisites — Locate project, confirm site-settings directory exists
Inspect current headers — Read site-setting YAML files, identify configured and missing headers
Assess and plan — Identify gaps, present recommendations
Apply changes — Edit existing settings or create new ones
Summarize — Present results, record usage, offer follow-ups

Task Tracking

Create tasks in four groups. Mark each in_progress when starting, completed when done.

Group	When to create	Tasks
1	At start	Check prerequisites
2	After prerequisites pass	Inspect current headers · Assess and plan (skip "Assess and plan" in review mode)
3	After user approves changes	Apply changes (skip in review mode OR if no changes were accepted)
4	After apply or assess	Summarize (always)

1. Prerequisites

1.1 Locate the project, detect review mode

Use Glob to find **/powerpages.config.json. If $ARGUMENTS contains --review <out-dir>, remember the output directory — Steps 3–4 are skipped and Step 5 writes JSON only.

1.2 Verify site-settings directory

Check that .powerpages-site/site-settings/ exists. If not, the site has not been deployed yet — tell the user and recommend /deploy-site. Stop.

2. Inspect current headers

Use Glob to find all *.yml files in .powerpages-site/site-settings/. Use Read to read each file and extract the name and value fields. Identify all settings with an HTTP/ prefix — these are the configured headers.

Compare against the recognized header catalogue in references/headers-reference.md. For each header in the catalogue: