Security finding
The CDN and the origin server send different security headers
Security Warning Severity: Medium
Part of the audit Security headers differ between parts of the same site. Finding id: security.headersCdnVsOrigin.
What it costs you
The same page has different protection depending on the route a request takes.
What to do
Set each security header in one place, and check both routes.
What it checks
- Headers differ between CDN and origin
How to fix it
Make the CDN pass the header on
- Look in the CDN configuration for a rule that removes or overwrites response headers. We do not name the menu because it differs per CDN.
- If the CDN serves cached copies made before the header existed, clear its cache.
- Otherwise set [header] at the CDN with the value the origin sends.
How to check: curl -sI https://[host]/ | grep -i [header]
Close the origin or set the header there too
- Allow connections to [origin address] from the CDN only, in the firewall of the server or the hosting provider.
- Or send [header] from the origin as well, with the same value.
How to check: Recrawl with the origin address entered: both routes send [header], or the origin no longer answers.
How to verify by hand
The server or CDN configuration.
What this relies on
The strongest set found is the intended standard.