Auditing HTTP security headers including CSP, HSTS, X-Frame-Options, and cookie attributes to identify missing or misconfigured browser-level protections.
Auditing HTTP security headers including CSP, HSTS, X-Frame-Options, and cookie attributes to identify missing or misconfigured browser-level protections.
Evaluate HTTP Strict Transport Security configuration.
# Check HSTS header
curl -s -I "https://target.example.com/" | grep -i "strict-transport-security"# Expected: Strict-Transport-Security: max-age=31536000; includeSubDomains; preload# Verify HSTS attributes:# max-age: Should be >= 31536000 (1 year) for preload eligibility# includeSubDomains: Protects all subdomains# preload: Eligible for browser HSTS preload list# Check if HTTP redirects to HTTPS
curl -s -I "http://target.example.com/" | head -5
# Should be 301/302 redirect to https://# Check if HSTS is on the preload list# Visit: https://hstspreload.org/?domain=target.example.com# Test for HTTPS-only cookies
curl -s -I "https://target.example.com/login" | grep -i "set-cookie"# All session cookies should have Secure flag# Check for mixed content
curl -s "https://target.example.com/" | grep -oP "http://[^\"']+" | head -20
# HTTP resources loaded on HTTPS pages create mixed content vulnerabilities
Step 3: Audit Content Security Policy (CSP)
Analyze CSP headers for effectiveness and potential bypasses.
# Extract CSP header
CSP=$(curl -s -I "https://target.example.com/" | grep -i "content-security-policy" | cut -d: -f2-)
echo"$CSP"# Check for dangerous directives:# 'unsafe-inline' in script-src: Allows inline scripts (XSS risk)# 'unsafe-eval' in script-src: Allows eval() (XSS risk)# * in any directive: Allows loading from any origin# data: in script-src: Allows data: URI scripts# Missing default-src: No fallback policyecho"$CSP" | tr';''\n' | whileread directive; doecho" $directive"ifecho"$directive" | grep -q "unsafe-inline"; thenecho" WARNING: unsafe-inline allows inline script execution"fiifecho"$directive" | grep -q "unsafe-eval"; thenecho" WARNING: unsafe-eval allows eval() calls"fiifecho"$directive" | grep -q " \* "; thenecho" WARNING: wildcard allows loading from any origin"fidone# Check for CSP report-only (not enforcing)
curl -s -I "https://target.example.com/" | grep -i "content-security-policy-report-only"# Report-only does NOT block violations, only logs them# Test CSP with Google's evaluator# https://csp-evaluator.withgoogle.com/# Paste the CSP header for automated analysis# Check for CSP bypass via whitelisted domains# If CDN domains are whitelisted, check for JSONP endpoints or angular libraries
Step 4: Check Frame Protection and Click Defense Headers
Verify anti-clickjacking and iframe embedding controls.
# X-Frame-Options
curl -s -I "https://target.example.com/" | grep -i "x-frame-options"# Expected: DENY or SAMEORIGIN# ALLOW-FROM is deprecated and not supported in modern browsers# CSP frame-ancestors (supersedes X-Frame-Options)
curl -s -I "https://target.example.com/" | grep -i "content-security-policy" | grep -o "frame-ancestors[^;]*"# Expected: frame-ancestors 'none' or frame-ancestors 'self'# X-Content-Type-Options
curl -s -I "https://target.example.com/" | grep -i "x-content-type-options"# Expected: nosniff (prevents MIME type sniffing)# X-XSS-Protection (legacy, but still useful for older browsers)
curl -s -I "https://target.example.com/" | grep -i "x-xss-protection"# Expected: 1; mode=block (or 0 if CSP is comprehensive)# Note: Modern recommendation is 0 (disable) when CSP is present# Referrer-Policy
curl -s -I "https://target.example.com/" | grep -i "referrer-policy"# Expected: strict-origin-when-cross-origin or no-referrer# Prevents sensitive URL data from leaking via Referer header
Step 5: Audit Cookie Security Attributes
Examine session and authentication cookies for security flags.
# Fetch all Set-Cookie headers
curl -s -I -L "https://target.example.com/login" | grep -i "set-cookie"# Check each cookie for required attributes:# Secure: Only sent over HTTPS# HttpOnly: Not accessible via JavaScript (prevents XSS cookie theft)# SameSite: Controls cross-site cookie sending (Strict, Lax, None)# Path: Restricts cookie scope# Domain: Controls which domains receive the cookie# Max-Age/Expires: Cookie lifetime# Automated cookie check
curl -s -I "https://target.example.com/login" | grep -i "set-cookie" | whileread line; doecho"Cookie: $(echo "$line" | grep -oP '[^:]+=[^;]+')"
missing=""echo"$line" | grep -qi "secure" || missing="$missing Secure"echo"$line" | grep -qi "httponly" || missing="$missing HttpOnly"echo"$line" | grep -qi "samesite" || missing="$missing SameSite"if [ -n "$missing" ]; thenecho" MISSING:$missing"elseecho" All flags present"fidone# Check for __Host- and __Secure- cookie prefixes# __Host- cookies must have Secure, Path=/, no Domain# __Secure- cookies must have Secure flag
Step 6: Check Permissions Policy and Information Disclosure
Review browser feature controls and information leakage headers.
# Permissions-Policy (formerly Feature-Policy)
curl -s -I "https://target.example.com/" | grep -i "permissions-policy"# Controls browser features: camera, microphone, geolocation, etc.# Expected: Restrict unused features# Example: permissions-policy: camera=(), microphone=(), geolocation=()# Cross-Origin headers
curl -s -I "https://target.example.com/" | grep -iE "(cross-origin-embedder|cross-origin-opener|cross-origin-resource)"# COEP: Cross-Origin-Embedder-Policy: require-corp# COOP: Cross-Origin-Opener-Policy: same-origin# CORP: Cross-Origin-Resource-Policy: same-origin# Information disclosure headers to flag
curl -s -I "https://target.example.com/" | grep -iE "(server|x-powered-by|x-aspnet|x-generator)"# Server: Apache/2.4.52 (should be removed or generic)# X-Powered-By: PHP/8.1.2 (should be removed)# These headers reveal technology stack to attackers# Cache-Control for sensitive pages
curl -s -I "https://target.example.com/account/settings" | grep -i "cache-control"# Sensitive pages should have: Cache-Control: no-store, no-cache, must-revalidate# Prevents browser caching of sensitive data# Generate comprehensive report using online toolsecho"Scan with SecurityHeaders.com: https://securityheaders.com/?q=target.example.com"echo"Scan with Mozilla Observatory: https://observatory.mozilla.org/analyze/target.example.com"
Key Concepts
Concept
Description
HSTS
Forces browsers to only use HTTPS for the domain, preventing protocol downgrade attacks
CSP
Restricts which resources (scripts, styles, images) can load on the page
X-Frame-Options
Controls whether the page can be embedded in iframes (clickjacking defense)
X-Content-Type-Options
Prevents MIME type sniffing; forces browser to respect declared Content-Type
Referrer-Policy
Controls how much referrer information is sent with cross-origin requests
Permissions-Policy
Restricts browser features (camera, microphone, geolocation) available to the page
SameSite Cookie
Controls when cookies are sent in cross-site contexts (Strict, Lax, None)
HSTS Preloading
Hardcoding HSTS policy in browser source code for first-visit protection
Comprehensive web security scanner with scoring and recommendations
CSP Evaluator (Google)
Analyzes Content Security Policy for weaknesses and bypasses
Burp Suite Professional
Inspecting response headers across all application pages
securityheaders (CLI)
Command-line security header scanner
Hardenize
TLS and security header monitoring service
Common Scenarios
Scenario 1: Complete Header Absence
A legacy application returns no security headers at all. No HSTS, CSP, X-Frame-Options, or cookie security flags. Every page is vulnerable to clickjacking, XSS has no browser-level mitigation, and cookies are sent over HTTP.
Scenario 2: Weak CSP with unsafe-inline
The CSP header includes script-src 'self' 'unsafe-inline'. While it restricts external script loading, the unsafe-inline directive allows any inline script to execute, rendering the CSP ineffective against XSS.
Scenario 3: Session Cookie Without Secure Flag
The session cookie is set without the Secure flag. On mixed HTTP/HTTPS sites, the session token can be intercepted by a network attacker via a plain HTTP request.
Scenario 4: Missing HSTS Enabling SSL Stripping
No HSTS header is present. An attacker on the network can perform an SSL stripping attack, downgrading the victim's HTTPS connection to HTTP and intercepting all traffic.
Output Format
## Security Headers Audit Report
**Target**: target.example.com
**Grade**: D (SecurityHeaders.com)
**Assessment Date**: 2024-01-15
### Headers Assessment
| Header | Status | Current Value | Recommended |
|--------|--------|---------------|-------------|
| Strict-Transport-Security | MISSING | - | max-age=31536000; includeSubDomains; preload |
| Content-Security-Policy | WEAK | script-src 'self' 'unsafe-inline' | script-src 'self' 'nonce-{random}' |
| X-Frame-Options | MISSING | - | DENY |
| X-Content-Type-Options | PRESENT | nosniff | nosniff (OK) |
| Referrer-Policy | MISSING | - | strict-origin-when-cross-origin |
| Permissions-Policy | MISSING | - | camera=(), microphone=(), geolocation=() |
| X-XSS-Protection | MISSING | - | 0 (with strong CSP) |
### Cookie Security
| Cookie | Secure | HttpOnly | SameSite | Path |
|--------|--------|----------|----------|------|
| session | NO | YES | Not set | / |
| user_pref | NO | NO | Not set | / |
| csrf_token | YES | NO | Strict | / |
### Information Disclosure
| Header | Value | Risk |
|--------|-------|------|
| Server | Apache/2.4.52 | Technology fingerprinting |
| X-Powered-By | PHP/8.1.2 | Version-specific exploit targeting |
### Recommendation Priority
1. **Critical**: Add Secure and SameSite flags to session cookie
2. **High**: Implement HSTS with min 1-year max-age
3. **High**: Replace 'unsafe-inline' in CSP with nonce-based policy
4. **Medium**: Add X-Frame-Options: DENY
5. **Medium**: Add Referrer-Policy: strict-origin-when-cross-origin
6. **Low**: Remove Server and X-Powered-By version information
7. **Low**: Add Permissions-Policy to restrict unused browser features
