Back to Details

performing-security-headers-audit

Compare original and translation side by side

🇺🇸

Original

English
🇨🇳

Translation

Chinese

Performing Security Headers Audit

执行安全标头审计

When to Use

适用场景

  • During authorized web application security assessments as a standard configuration review
  • When evaluating browser-level protections against XSS, clickjacking, and data leakage
  • For compliance assessments requiring security header implementation (PCI DSS, SOC 2)
  • When performing initial reconnaissance to identify easy-win security improvements
  • During CI/CD pipeline security gate checks for new deployments
  • 在授权的Web应用安全评估中作为标准配置审查环节
  • 评估针对XSS、点击劫持和数据泄露的浏览器级防护措施时
  • 针对要求实现安全标头的合规性评估（如PCI DSS、SOC 2）
  • 执行初始侦察以识别易实施的安全改进点时
  • 在CI/CD流水线的安全网关检查中针对新部署进行审查

Prerequisites

前提条件

  • Authorization: Written scope for the target application (header review is low-risk)
  • curl: For fetching response headers from target endpoints
  • SecurityHeaders.com: Online scanner for quick header assessment
  • Mozilla Observatory: Mozilla's web security testing tool
  • Burp Suite: For comprehensive header analysis across multiple pages
  • Browser DevTools: For examining headers and CSP violations in real-time
  • 授权：目标应用的书面审查范围（标头审查风险较低）
  • curl：用于从目标端点获取响应标头
  • SecurityHeaders.com：用于快速评估标头的在线扫描工具
  • Mozilla Observatory：Mozilla的Web安全测试工具
  • Burp Suite：用于跨多页面进行全面的标头分析
  • Browser DevTools：用于实时检查标头和CSP违规情况

Workflow

工作流程

Step 1: Collect Security Headers from Target

步骤1：收集目标的安全标头

Retrieve and catalog all security-related response headers.
bash
undefined
检索并分类所有与安全相关的响应标头。
bash
undefined

Fetch all response headers

Fetch all response headers

curl -s -I "https://target.example.com/" | grep -iE
"(strict-transport|content-security|x-frame|x-content-type|x-xss|referrer-policy|permissions-policy|feature-policy|x-permitted|cross-origin|set-cookie|server|x-powered-by|cache-control)"
curl -s -I "https://target.example.com/" | grep -iE
"(strict-transport|content-security|x-frame|x-content-type|x-xss|referrer-policy|permissions-policy|feature-policy|x-permitted|cross-origin|set-cookie|server|x-powered-by|cache-control)"

Check headers across multiple pages

Check headers across multiple pages

PAGES=("/" "/login" "/api/health" "/admin" "/account/settings" "/static/app.js")
for page in "${PAGES[@]}"; do echo "=== $page ===" curl -s -I "https://target.example.com$page" 2>/dev/null | grep -iE
"(strict-transport|content-security|x-frame|x-content-type|x-xss|referrer-policy|permissions-policy|set-cookie|server|x-powered)" echo done
PAGES=("/" "/login" "/api/health" "/admin" "/account/settings" "/static/app.js")
for page in "${PAGES[@]}"; do echo "=== $page ===" curl -s -I "https://target.example.com$page" 2>/dev/null | grep -iE
"(strict-transport|content-security|x-frame|x-content-type|x-xss|referrer-policy|permissions-policy|set-cookie|server|x-powered)" echo done

Check both HTTP and HTTPS responses

Check both HTTP and HTTPS responses

echo "=== HTTP Response ===" curl -s -I "http://target.example.com/" | head -20 echo "=== HTTPS Response ===" curl -s -I "https://target.example.com/" | head -20
undefined
echo "=== HTTP Response ===" curl -s -I "http://target.example.com/" | head -20 echo "=== HTTPS Response ===" curl -s -I "https://target.example.com/" | head -20
undefined

Step 2: Assess Transport Security (HSTS)

步骤2：评估传输安全（HSTS）

Evaluate HTTP Strict Transport Security configuration.
bash
undefined
评估HTTP严格传输安全配置。
bash
undefined

Check HSTS header

Check HSTS header

curl -s -I "https://target.example.com/" | grep -i "strict-transport-security"
curl -s -I "https://target.example.com/" | grep -i "strict-transport-security"

Expected: Strict-Transport-Security: max-age=31536000; includeSubDomains; preload

Expected: Strict-Transport-Security: max-age=31536000; includeSubDomains; preload

Verify HSTS attributes:

Verify HSTS attributes:

max-age: Should be >= 31536000 (1 year) for preload eligibility

max-age: Should be >= 31536000 (1 year) for preload eligibility

includeSubDomains: Protects all subdomains

includeSubDomains: Protects all subdomains

preload: Eligible for browser HSTS preload list

preload: Eligible for browser HSTS preload list

Check if HTTP redirects to HTTPS

Check if HTTP redirects to HTTPS

curl -s -I "http://target.example.com/" | head -5
curl -s -I "http://target.example.com/" | head -5

Should be 301/302 redirect to https://

Should be 301/302 redirect to https://

Check if HSTS is on the preload list

Check if HSTS is on the preload list

Visit: https://hstspreload.org/?domain=target.example.com

Visit: https://hstspreload.org/?domain=target.example.com

Test for HTTPS-only cookies

Test for HTTPS-only cookies

curl -s -I "https://target.example.com/login" | grep -i "set-cookie"
curl -s -I "https://target.example.com/login" | grep -i "set-cookie"

All session cookies should have Secure flag

All session cookies should have Secure flag

Check for mixed content

Check for mixed content

curl -s "https://target.example.com/" | grep -oP "http://[^"']+" | head -20
curl -s "https://target.example.com/" | grep -oP "http://[^"']+" | head -20

HTTP resources loaded on HTTPS pages create mixed content vulnerabilities

HTTP resources loaded on HTTPS pages create mixed content vulnerabilities

undefined
undefined

Step 3: Audit Content Security Policy (CSP)

步骤3：审计内容安全策略（CSP）

Analyze CSP headers for effectiveness and potential bypasses.
bash
undefined
分析CSP标头的有效性和潜在绕过风险。
bash
undefined

Extract CSP header

Extract CSP header

CSP=$(curl -s -I "https://target.example.com/" | grep -i "content-security-policy" | cut -d: -f2-) echo "$CSP"
CSP=$(curl -s -I "https://target.example.com/" | grep -i "content-security-policy" | cut -d: -f2-) echo "$CSP"

Check for dangerous directives:

Check for dangerous directives:

'unsafe-inline' in script-src: Allows inline scripts (XSS risk)

'unsafe-inline' in script-src: Allows inline scripts (XSS risk)

'unsafe-eval' in script-src: Allows eval() (XSS risk)

'unsafe-eval' in script-src: Allows eval() (XSS risk)

* in any directive: Allows loading from any origin

* in any directive: Allows loading from any origin

data: in script-src: Allows data: URI scripts

data: in script-src: Allows data: URI scripts

Missing default-src: No fallback policy

Missing default-src: No fallback policy

echo "$CSP" | tr ';' '\n' | while read directive; do echo " $directive" if echo "$directive" | grep -q "unsafe-inline"; then echo " WARNING: unsafe-inline allows inline script execution" fi if echo "$directive" | grep -q "unsafe-eval"; then echo " WARNING: unsafe-eval allows eval() calls" fi if echo "$directive" | grep -q " * "; then echo " WARNING: wildcard allows loading from any origin" fi done
echo "$CSP" | tr ';' '\n' | while read directive; do echo " $directive" if echo "$directive" | grep -q "unsafe-inline"; then echo " WARNING: unsafe-inline allows inline script execution" fi if echo "$directive" | grep -q "unsafe-eval"; then echo " WARNING: unsafe-eval allows eval() calls" fi if echo "$directive" | grep -q " * "; then echo " WARNING: wildcard allows loading from any origin" fi done

Check for CSP report-only (not enforcing)

Check for CSP report-only (not enforcing)

curl -s -I "https://target.example.com/" | grep -i "content-security-policy-report-only"
curl -s -I "https://target.example.com/" | grep -i "content-security-policy-report-only"

Report-only does NOT block violations, only logs them

Report-only does NOT block violations, only logs them

Test CSP with Google's evaluator

Test CSP with Google's evaluator

https://csp-evaluator.withgoogle.com/

https://csp-evaluator.withgoogle.com/

Paste the CSP header for automated analysis

Paste the CSP header for automated analysis

Check for CSP bypass via whitelisted domains

Check for CSP bypass via whitelisted domains

If CDN domains are whitelisted, check for JSONP endpoints or angular libraries

If CDN domains are whitelisted, check for JSONP endpoints or angular libraries

undefined
undefined

Step 4: Check Frame Protection and Click Defense Headers

步骤4：检查框架防护和点击防御标头

Verify anti-clickjacking and iframe embedding controls.
bash
undefined
验证反点击劫持和iframe嵌入控制措施。
bash
undefined

X-Frame-Options

X-Frame-Options

curl -s -I "https://target.example.com/" | grep -i "x-frame-options"
curl -s -I "https://target.example.com/" | grep -i "x-frame-options"

Expected: DENY or SAMEORIGIN

Expected: DENY or SAMEORIGIN

ALLOW-FROM is deprecated and not supported in modern browsers

ALLOW-FROM is deprecated and not supported in modern browsers

CSP frame-ancestors (supersedes X-Frame-Options)

CSP frame-ancestors (supersedes X-Frame-Options)

curl -s -I "https://target.example.com/" | grep -i "content-security-policy" | grep -o "frame-ancestors[^;]*"
curl -s -I "https://target.example.com/" | grep -i "content-security-policy" | grep -o "frame-ancestors[^;]*"

Expected: frame-ancestors 'none' or frame-ancestors 'self'

Expected: frame-ancestors 'none' or frame-ancestors 'self'

X-Content-Type-Options

X-Content-Type-Options

curl -s -I "https://target.example.com/" | grep -i "x-content-type-options"
curl -s -I "https://target.example.com/" | grep -i "x-content-type-options"

Expected: nosniff (prevents MIME type sniffing)

Expected: nosniff (prevents MIME type sniffing)

X-XSS-Protection (legacy, but still useful for older browsers)

X-XSS-Protection (legacy, but still useful for older browsers)

curl -s -I "https://target.example.com/" | grep -i "x-xss-protection"
curl -s -I "https://target.example.com/" | grep -i "x-xss-protection"

Expected: 1; mode=block (or 0 if CSP is comprehensive)

Expected: 1; mode=block (or 0 if CSP is comprehensive)

Note: Modern recommendation is 0 (disable) when CSP is present

Note: Modern recommendation is 0 (disable) when CSP is present

Referrer-Policy

Referrer-Policy

curl -s -I "https://target.example.com/" | grep -i "referrer-policy"
curl -s -I "https://target.example.com/" | grep -i "referrer-policy"

Expected: strict-origin-when-cross-origin or no-referrer

Expected: strict-origin-when-cross-origin or no-referrer

Prevents sensitive URL data from leaking via Referer header

Prevents sensitive URL data from leaking via Referer header

undefined
undefined

Step 5: Audit Cookie Security Attributes

步骤5：审计Cookie安全属性

Examine session and authentication cookies for security flags.
bash
undefined
检查会话和认证Cookie的安全标志。
bash
undefined

Fetch all Set-Cookie headers

Fetch all Set-Cookie headers

curl -s -I -L "https://target.example.com/login" | grep -i "set-cookie"
curl -s -I -L "https://target.example.com/login" | grep -i "set-cookie"

Check each cookie for required attributes:

Check each cookie for required attributes:

Secure: Only sent over HTTPS

Secure: Only sent over HTTPS

HttpOnly: Not accessible via JavaScript (prevents XSS cookie theft)

HttpOnly: Not accessible via JavaScript (prevents XSS cookie theft)

SameSite: Controls cross-site cookie sending (Strict, Lax, None)

SameSite: Controls cross-site cookie sending (Strict, Lax, None)

Path: Restricts cookie scope

Path: Restricts cookie scope

Domain: Controls which domains receive the cookie

Domain: Controls which domains receive the cookie

Max-Age/Expires: Cookie lifetime

Max-Age/Expires: Cookie lifetime

Automated cookie check

Automated cookie check

curl -s -I "https://target.example.com/login" | grep -i "set-cookie" | while read line; do echo "Cookie: $(echo "$line" | grep -oP '[^:]+=[^;]+')" missing="" echo "$line" | grep -qi "secure" || missing="$missing Secure" echo "$line" | grep -qi "httponly" || missing="$missing HttpOnly" echo "$line" | grep -qi "samesite" || missing="$missing SameSite" if [ -n "$missing" ]; then echo " MISSING:$missing" else echo " All flags present" fi done
curl -s -I "https://target.example.com/login" | grep -i "set-cookie" | while read line; do echo "Cookie: $(echo "$line" | grep -oP '[^:]+=[^;]+')" missing="" echo "$line" | grep -qi "secure" || missing="$missing Secure" echo "$line" | grep -qi "httponly" || missing="$missing HttpOnly" echo "$line" | grep -qi "samesite" || missing="$missing SameSite" if [ -n "$missing" ]; then echo " MISSING:$missing" else echo " All flags present" fi done

Check for __Host- and __Secure- cookie prefixes

Check for __Host- and __Secure- cookie prefixes

__Host- cookies must have Secure, Path=/, no Domain

__Host- cookies must have Secure, Path=/, no Domain

__Secure- cookies must have Secure flag

__Secure- cookies must have Secure flag

undefined
undefined

Step 6: Check Permissions Policy and Information Disclosure

步骤6：检查权限策略和信息泄露

Review browser feature controls and information leakage headers.
bash
undefined
审查浏览器功能控制和信息泄露标头。
bash
undefined

Permissions-Policy (formerly Feature-Policy)

Permissions-Policy (formerly Feature-Policy)

curl -s -I "https://target.example.com/" | grep -i "permissions-policy"
curl -s -I "https://target.example.com/" | grep -i "permissions-policy"

Controls browser features: camera, microphone, geolocation, etc.

Controls browser features: camera, microphone, geolocation, etc.

Expected: Restrict unused features

Expected: Restrict unused features

Example: permissions-policy: camera=(), microphone=(), geolocation=()

Example: permissions-policy: camera=(), microphone=(), geolocation=()

Cross-Origin headers

Cross-Origin headers

curl -s -I "https://target.example.com/" | grep -iE "(cross-origin-embedder|cross-origin-opener|cross-origin-resource)"
curl -s -I "https://target.example.com/" | grep -iE "(cross-origin-embedder|cross-origin-opener|cross-origin-resource)"

COEP: Cross-Origin-Embedder-Policy: require-corp

COEP: Cross-Origin-Embedder-Policy: require-corp

COOP: Cross-Origin-Opener-Policy: same-origin

COOP: Cross-Origin-Opener-Policy: same-origin

CORP: Cross-Origin-Resource-Policy: same-origin

CORP: Cross-Origin-Resource-Policy: same-origin

Information disclosure headers to flag

Information disclosure headers to flag

curl -s -I "https://target.example.com/" | grep -iE "(server|x-powered-by|x-aspnet|x-generator)"
curl -s -I "https://target.example.com/" | grep -iE "(server|x-powered-by|x-aspnet|x-generator)"

Server: Apache/2.4.52 (should be removed or generic)

Server: Apache/2.4.52 (should be removed or generic)

X-Powered-By: PHP/8.1.2 (should be removed)

X-Powered-By: PHP/8.1.2 (should be removed)

These headers reveal technology stack to attackers

These headers reveal technology stack to attackers

Cache-Control for sensitive pages

Cache-Control for sensitive pages

curl -s -I "https://target.example.com/account/settings" | grep -i "cache-control"
curl -s -I "https://target.example.com/account/settings" | grep -i "cache-control"

Sensitive pages should have: Cache-Control: no-store, no-cache, must-revalidate

Sensitive pages should have: Cache-Control: no-store, no-cache, must-revalidate

Prevents browser caching of sensitive data

Prevents browser caching of sensitive data

Generate comprehensive report using online tools

Generate comprehensive report using online tools

echo "Scan with SecurityHeaders.com: https://securityheaders.com/?q=target.example.com" echo "Scan with Mozilla Observatory: https://observatory.mozilla.org/analyze/target.example.com"
undefined
echo "Scan with SecurityHeaders.com: https://securityheaders.com/?q=target.example.com" echo "Scan with Mozilla Observatory: https://observatory.mozilla.org/analyze/target.example.com"
undefined

Key Concepts

核心概念

ConceptDescription
HSTSForces browsers to only use HTTPS for the domain, preventing protocol downgrade attacks
CSPRestricts which resources (scripts, styles, images) can load on the page
X-Frame-OptionsControls whether the page can be embedded in iframes (clickjacking defense)
X-Content-Type-OptionsPrevents MIME type sniffing; forces browser to respect declared Content-Type
Referrer-PolicyControls how much referrer information is sent with cross-origin requests
Permissions-PolicyRestricts browser features (camera, microphone, geolocation) available to the page
SameSite CookieControls when cookies are sent in cross-site contexts (Strict, Lax, None)
HSTS PreloadingHardcoding HSTS policy in browser source code for first-visit protection
概念描述
HSTS强制浏览器仅对该域名使用HTTPS，防止协议降级攻击
CSP限制页面可加载的资源（脚本、样式、图片等）
X-Frame-Options控制页面是否可嵌入到iframe中（点击劫持防御措施）
X-Content-Type-Options防止MIME类型嗅探；强制浏览器遵循声明的Content-Type
Referrer-Policy控制跨源请求时发送的引用信息数量
Permissions-Policy限制页面可使用的浏览器功能（摄像头、麦克风、地理位置等）
SameSite Cookie控制Cookie在跨站上下文何时发送（Strict、Lax、None）
HSTS Preloading将HSTS策略硬编码到浏览器源代码中，提供首次访问防护

Tools & Systems

工具与系统

ToolPurpose
SecurityHeaders.comOnline scanner providing letter-grade security header assessment
Mozilla ObservatoryComprehensive web security scanner with scoring and recommendations
CSP Evaluator (Google)Analyzes Content Security Policy for weaknesses and bypasses
Burp Suite ProfessionalInspecting response headers across all application pages
securityheaders (CLI)Command-line security header scanner
HardenizeTLS and security header monitoring service
工具用途
SecurityHeaders.com提供字母等级安全标头评估的在线扫描工具
Mozilla Observatory带有评分和建议的全面Web安全扫描工具
CSP Evaluator (Google)分析内容安全策略的弱点和绕过风险
Burp Suite Professional检查所有应用页面的响应标头
securityheaders (CLI)命令行安全标头扫描工具
HardenizeTLS和安全标头监控服务

Common Scenarios

常见场景

Scenario 1: Complete Header Absence

场景1：完全缺失标头

A legacy application returns no security headers at all. No HSTS, CSP, X-Frame-Options, or cookie security flags. Every page is vulnerable to clickjacking, XSS has no browser-level mitigation, and cookies are sent over HTTP.
遗留应用未返回任何安全标头。没有HSTS、CSP、X-Frame-Options或Cookie安全标志。每个页面都易受点击劫持攻击，XSS没有浏览器级缓解措施，Cookie会通过HTTP发送。

Scenario 2: Weak CSP with unsafe-inline

场景2：包含unsafe-inline的弱CSP

The CSP header includes 
script-src 'self' 'unsafe-inline'
. While it restricts external script loading, the 
unsafe-inline
directive allows any inline script to execute, rendering the CSP ineffective against XSS.
CSP标头包含
script-src 'self' 'unsafe-inline'
。虽然它限制了外部脚本加载，但
unsafe-inline
指令允许任何内联脚本执行，使CSP对XSS的防护失效。

Scenario 3: Session Cookie Without Secure Flag

场景3：无Secure标志的会话Cookie

The session cookie is set without the 
Secure
flag. On mixed HTTP/HTTPS sites, the session token can be intercepted by a network attacker via a plain HTTP request.
会话Cookie未设置
Secure
标志。在混合HTTP/HTTPS站点上，会话令牌可能被网络攻击者通过纯HTTP请求拦截。

Scenario 4: Missing HSTS Enabling SSL Stripping

场景4：缺失HSTS导致SSL剥离攻击

No HSTS header is present. An attacker on the network can perform an SSL stripping attack, downgrading the victim's HTTPS connection to HTTP and intercepting all traffic.
不存在HSTS标头。网络上的攻击者可以执行SSL剥离攻击，将受害者的HTTPS连接降级为HTTP并拦截所有流量。

Output Format

输出格式

undefined
undefined

Security Headers Audit Report

Security Headers Audit Report

Target: target.example.com Grade: D (SecurityHeaders.com) Assessment Date: 2024-01-15
Target: target.example.com Grade: D (SecurityHeaders.com) Assessment Date: 2024-01-15

Headers Assessment

Headers Assessment

HeaderStatusCurrent ValueRecommended
Strict-Transport-SecurityMISSING-max-age=31536000; includeSubDomains; preload
Content-Security-PolicyWEAKscript-src 'self' 'unsafe-inline'script-src 'self' 'nonce-{random}'
X-Frame-OptionsMISSING-DENY
X-Content-Type-OptionsPRESENTnosniffnosniff (OK)
Referrer-PolicyMISSING-strict-origin-when-cross-origin
Permissions-PolicyMISSING-camera=(), microphone=(), geolocation=()
X-XSS-ProtectionMISSING-0 (with strong CSP)
HeaderStatusCurrent ValueRecommended
Strict-Transport-SecurityMISSING-max-age=31536000; includeSubDomains; preload
Content-Security-PolicyWEAKscript-src 'self' 'unsafe-inline'script-src 'self' 'nonce-{random}'
X-Frame-OptionsMISSING-DENY
X-Content-Type-OptionsPRESENTnosniffnosniff (OK)
Referrer-PolicyMISSING-strict-origin-when-cross-origin
Permissions-PolicyMISSING-camera=(), microphone=(), geolocation=()
X-XSS-ProtectionMISSING-0 (with strong CSP)

Cookie Security

Cookie Security

CookieSecureHttpOnlySameSitePath
sessionNOYESNot set/
user_prefNONONot set/
csrf_tokenYESNOStrict/
CookieSecureHttpOnlySameSitePath
sessionNOYESNot set/
user_prefNONONot set/
csrf_tokenYESNOStrict/

Information Disclosure

Information Disclosure

HeaderValueRisk
ServerApache/2.4.52Technology fingerprinting
X-Powered-ByPHP/8.1.2Version-specific exploit targeting
HeaderValueRisk
ServerApache/2.4.52Technology fingerprinting
X-Powered-ByPHP/8.1.2Version-specific exploit targeting

Recommendation Priority

Recommendation Priority

  1. Critical: Add Secure and SameSite flags to session cookie
  2. High: Implement HSTS with min 1-year max-age
  3. High: Replace 'unsafe-inline' in CSP with nonce-based policy
  4. Medium: Add X-Frame-Options: DENY
  5. Medium: Add Referrer-Policy: strict-origin-when-cross-origin
  6. Low: Remove Server and X-Powered-By version information
  7. Low: Add Permissions-Policy to restrict unused browser features
undefined
  1. Critical: Add Secure and SameSite flags to session cookie
  2. High: Implement HSTS with min 1-year max-age
  3. High: Replace 'unsafe-inline' in CSP with nonce-based policy
  4. Medium: Add X-Frame-Options: DENY
  5. Medium: Add Referrer-Policy: strict-origin-when-cross-origin
  6. Low: Remove Server and X-Powered-By version information
  7. Low: Add Permissions-Policy to restrict unused browser features
undefined