Security audit
Security headers
Audit id: security.headers.
Checks
- Content security policy missing or unsafe
- No protection against being embedded in other sites
- File type sniffing not switched off
- No rule on sharing the previous page address
- No limits on browser features
- No cross-site isolation settings
- Security settings differ between page types
- Policy trusts a site anyone can publish on
- Policy has no default source rule
- Policy has no rule for plugins
- Policy has no rule for base address
- Policy only set in an outdated header
- Outdated browser filter switched on
- File type sniffing setting is wrong
- Any site may read logged-in data
- Any site may read pages that set cookies
- Cached page sets a cookie
Findings
- A page that sets a cookie may be stored in a shared cache
- A response lets any website read it
- The Content-Security-Policy leaves out default-src, object-src or base-uri
- The Content-Security-Policy allows scripts from a host where anyone can publish
- The Content-Security-Policy allows what it is meant to stop
- A security header is sent under an old name or with a wrong value
- HTML pages are sent without a security header