update

Author: amirhhashemi

src/routes/solid-start/guides/security.mdx

@@ -13,10 +13,11 @@ To protect your application from XSS attacks:
 
 1. Avoid using [`innerHTML`](/reference/jsx-attributes/innerhtml-or-textcontent#innerhtml-or-textcontent) when possible.
    If you must use it, sanitize the content before rendering with libraries such as [DOMPurify](https://github.com/cure53/DOMPurify).
-2. Set a Content Security Policy (CSP).
-3. Validate and sanitize user inputs.
+2. Validate and sanitize user inputs.
    Always validate form inputs on the server in addition to the client.
-4. Use the `HttpOnly` and `Secure` attributes on cookies.
+3. Set a Content Security Policy (CSP).
+
+We highly recommend you read [Cross Site Scripting Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html) for more guidance.
 
 ## CSP (Content Security Policy)
 
@@ -141,7 +142,7 @@ export default createMiddleware({
 
 ## CSRF (Cross-Site Request Forgery)
 
-To prevent CSRF attacks, you can use a middleware to block untrusted requests.
+To prevent CSRF attacks, you can use a middleware to block untrusted requests:
 
 ```tsx
 import { createMiddleware } from "@solidjs/start/middleware";
@@ -201,4 +202,4 @@ export default createMiddleware({
 This example demonstrates a basic implementation of CSRF protection that checks for the `Origin` and `Referer` headers and blocks requests that are not from trusted origins.
 In addition, consider implementing a more comprehensive CSRF protection mechanism such as [Double-Submit Cookie Pattern](https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html#alternative-using-a-double-submit-cookie-pattern).
 
-We highly recommend you read through [Cross-Site Request Forgery Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html) for more guidance.
+We highly recommend you read [Cross-Site Request Forgery Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html) for more guidance.