Humble HTTP headers analyzer
 (https://github.com/rfc-st/humble)



[0. Info]

 Date : 2023/11/10 - 19:02:49
 URL  : https://www.spacex.com


[1. Missing HTTP Security Headers]

 Clear-Site-Data
 Clears browsing data (cookies, storage, cache) associated with the requesting website.
 Ref: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Clear-Site-Data

 Cross-Origin-Embedder-Policy
 Prevents documents and workers from loading non-same-origin requests unless allowed.
 Ref: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Cross-Origin-Embedder-Policy

 Cross-Origin-Opener-Policy
 Prevent other websites from gaining arbitrary window references to a page.
 Ref: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Cross-Origin-Opener-Policy

 Cross-Origin-Resource-Policy
 Protect servers against certain cross-origin or cross-site embedding of the returned source.
 Ref: https://developer.mozilla.org/en-US/docs/Web/HTTP/Cross-Origin_Resource_Policy_(CORP)

 Content-Security-Policy
 Detect and mitigate Cross Site Scripting (XSS) and data injection attacks, among others.
 Ref: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy

 NEL
 Enables web applications to declare a reporting policy to report errors.
 Ref: https://scotthelme.co.uk/network-error-logging-deep-dive/

 Permissions-Policy
 Previously called "Feature-Policy", allow and deny the use of browser features.
 Ref: https://scotthelme.co.uk/goodbye-feature-policy-and-hello-permissions-policy/

 Referrer-Policy
 Controls how much referrer information should be included with requests.
 Ref: https://scotthelme.co.uk/a-new-security-header-referrer-policy/

 X-Content-Type-Options
 Indicate that MIME types in the "Content-Type" headers should be followed.
 Ref: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Content-Type-Options

 X-Permitted-Cross-Domain-Policies
 Limit which data external resources (e.g. Adobe Flash/PDF documents), can access on the domain.
 Ref: https://owasp.org/www-project-secure-headers/#div-headers

 X-Frame-Options
 Prevents clickjacking attacks, limiting sources of embedded content.
 Ref: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options


[2. Fingerprint HTTP Response Headers]

 These headers can leak information about software, versions, hostnames or IP addresses:

 Server [Generic HTTP Server/Content Delivery Network]
 whydoyoucare?

 Via [Generic Proxy server]
 1.1 varnish, 1.1 varnish

 X-Served-By [Generic HTTP Server/Content Delivery Network]
 cache-bur-kbur8200135-BUR, cache-mad2200096-MAD


[3. Deprecated HTTP Response Headers/Protocols and Insecure Values]

 The following headers/protocols are deprecated or their values may be considered unsafe:

 Cache-Control (Recommended Values)
 Enable 'no-cache', 'no-store', and 'must-revalidate' if there are sensitive data.
 Ref: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Cache-Control

 Etag (Potentially Unsafe Header)
 Although unlikely to be exploited, this header should not include inode information.
 Ref: https://www.pentestpartners.com/security-blog/vulnerabilities-that-arent-etag-headers/

 Expires (Ignored Header)
 Header ignored by the directives 'max-age' or 's-maxage' in in the header that controls the cache.
 Ref: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Expires

 Strict-Transport-Security (Recommended Values)
 Add 'includeSubDomains' and set 'max-age' to at least 31536000 (one year).
 Ref: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security
 Ref: https://https.cio.gov/hsts/


[4. Empty HTTP Response Headers Values]

 The following headers have no value (could be equivalent to as if they were not enabled):

 Nothing to report, all seems OK!


[5. Browser Compatibility for Enabled HTTP Security Headers]

 Cache-Control: https://caniuse.com/?search=Cache-Control
 Content-Type: https://caniuse.com/?search=Content-Type
 Strict-Transport-Security: https://caniuse.com/?search=Strict-Transport-Security


.:

Analysis done in 0.45 seconds! (changes with respect to the last analysis in parentheses)

  Missing headers:              11 (First Analysis)
  Fingerprint headers:          3 (First Analysis)
  Deprecated/Insecure headers:  4 (First Analysis)
  Empty headers:                0 (First Analysis)

  Warnings to review:           18 (First Analysis)