Odoo Web Security

Use this skill at every Odoo web trust boundary. Compose it with odoo-website, odoo-code-review, and the version-specific Odoo skill.

Threat Model First

Identify the caller, authentication mode, record being accessed, mutation being performed, and data that crosses the browser boundary. Treat route parameters, query strings, form fields, JSON payloads, headers, cookies, and browser state as attacker-controlled.

Read SECURITY-CHECKLIST.md before editing or approving a web-facing change.

Non-Negotiable Checks

• auth='public' is not a substitute for a publication policy.
• Portal identity and record ownership must be checked server-side.
• sudo() must be narrow, justified, and followed by an explicit visibility check.
• Never authorize a record from its numeric ID, token shape, or hidden form field alone.
• Use ORM security and record rules where possible; do not bypass them with raw SQL or broad elevation.
• Escape output by default and review HTML sanitization separately from escaping.
• Validate redirects, URLs, uploaded files, and external API destinations.
• Preserve CSRF protection for state-changing browser requests according to the route type and target version.

Review Output

For each finding, state the attacker, entry point, missing control, affected data/action, and a concrete test that would fail before the fix.