Humble HTTP headers analyzer
(https://github.com/rfc-st/humble)
[0. Info]
Date : 2023/11/10 - 19:02:49
URL : https://www.spacex.com
[1. Missing HTTP Security Headers]
Clear-Site-Data
Clears browsing data (cookies, storage, cache) associated with the requesting website.
Ref: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Clear-Site-Data
Cross-Origin-Embedder-Policy
Prevents documents and workers from loading non-same-origin requests unless allowed.
Ref: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Cross-Origin-Embedder-Policy
Cross-Origin-Opener-Policy
Prevent other websites from gaining arbitrary window references to a page.
Ref: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Cross-Origin-Opener-Policy
Cross-Origin-Resource-Policy
Protect servers against certain cross-origin or cross-site embedding of the returned source.
Ref: https://developer.mozilla.org/en-US/docs/Web/HTTP/Cross-Origin_Resource_Policy_(CORP)
Content-Security-Policy
Detect and mitigate Cross Site Scripting (XSS) and data injection attacks, among others.
Ref: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy
NEL
Enables web applications to declare a reporting policy to report errors.
Ref: https://scotthelme.co.uk/network-error-logging-deep-dive/
Permissions-Policy
Previously called "Feature-Policy", allow and deny the use of browser features.
Ref: https://scotthelme.co.uk/goodbye-feature-policy-and-hello-permissions-policy/
Referrer-Policy
Controls how much referrer information should be included with requests.
Ref: https://scotthelme.co.uk/a-new-security-header-referrer-policy/
X-Content-Type-Options
Indicate that MIME types in the "Content-Type" headers should be followed.
Ref: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Content-Type-Options
X-Permitted-Cross-Domain-Policies
Limit which data external resources (e.g. Adobe Flash/PDF documents), can access on the domain.
Ref: https://owasp.org/www-project-secure-headers/#div-headers
X-Frame-Options
Prevents clickjacking attacks, limiting sources of embedded content.
Ref: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options
[2. Fingerprint HTTP Response Headers]
These headers can leak information about software, versions, hostnames or IP addresses:
Server [Generic HTTP Server/Content Delivery Network]
whydoyoucare?
Via [Generic Proxy server]
1.1 varnish, 1.1 varnish
X-Served-By [Generic HTTP Server/Content Delivery Network]
cache-bur-kbur8200135-BUR, cache-mad2200096-MAD
[3. Deprecated HTTP Response Headers/Protocols and Insecure Values]
The following headers/protocols are deprecated or their values may be considered unsafe:
Cache-Control (Recommended Values)
Enable 'no-cache', 'no-store', and 'must-revalidate' if there are sensitive data.
Ref: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Cache-Control
Etag (Potentially Unsafe Header)
Although unlikely to be exploited, this header should not include inode information.
Ref: https://www.pentestpartners.com/security-blog/vulnerabilities-that-arent-etag-headers/
Expires (Ignored Header)
Header ignored by the directives 'max-age' or 's-maxage' in in the header that controls the cache.
Ref: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Expires
Strict-Transport-Security (Recommended Values)
Add 'includeSubDomains' and set 'max-age' to at least 31536000 (one year).
Ref: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security
Ref: https://https.cio.gov/hsts/
[4. Empty HTTP Response Headers Values]
The following headers have no value (could be equivalent to as if they were not enabled):
Nothing to report, all seems OK!
[5. Browser Compatibility for Enabled HTTP Security Headers]
https://caniuse.com/?search=Cache-Control
https://caniuse.com/?search=Content-Type
https://caniuse.com/?search=Strict-Transport-Security
.:
Analysis done in 0.45 seconds! (changes with respect to the last analysis in parentheses)
Missing headers: 11 (First Analysis)
Fingerprint headers: 3 (First Analysis)
Deprecated/Insecure headers: 4 (First Analysis)
Empty headers: 0 (First Analysis)
Warnings to review: 18 (First Analysis)