Skip to content
master
Go to file
Code

Latest commit

 

Git stats

Files

Permalink
Failed to load latest commit information.
Type
Name
Latest commit message
Commit time
exe
 
 
lib
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 

README.md

Http Headers Verifier

Gem Version Build Status

Assertation framework for http-headers on top of live endpoints, Verify a pre-defined HTTP headers configurations.

Unlike some other similar projects, this is not meant to enforce best practices, instead it is meant to define policies on top of headers and enforce them. As a side effect, this means you can define specific OWASP (for example) best practices and verify them, but unlike testing for best practices, this is inteneded to verify an expected headers configuration behavior.

Relevant use cases are for example when updating nginx/caddy configuration or when moving from one web-server to another and expecting to maintain a specific set of header config.

Usage

usage: http-headers-verifier.rb [comma seperated policy names] [url] [?verbose]

Example

$> http-headers-verifier.rb  default,hs-default https://my.login.page/login verbose

Starting verification of policies default, hs-default, hs-production:
	🍏 Expected Header 'Cache-Control' matched!
	🍏 Expected Header 'Content-Type' matched!
	🍏 Expected Header 'Vary' matched!
	🍏 Expected Header 'Content-Security-Policy' matched!
	🍏 Expected Header 'Expires' matched!
	🍏 Expected Header 'X-Frame-Options' matched!
	🍏 Expected Header 'X-XSS-Protection' matched!
	🍏 Expected Header 'X-Content-Type-Options' matched!
	🍏 Expected Header 'X-Whoami' matched!
	🍏 Expected Header 'Strict-Transport-Security' matched!
	🍏 Extra Header 'date' marked for ignore!
	🍏 Extra Header 'content-length' marked for ignore!
	🍏 Cookie 'AWSALB' passed verification!
	🍏 Cookie 'AWSALBCORS' passed verification!
	🍏 Cookie 'session' passed verification!
😎  Success !

Or in non-verbose mode:

$> http-headers-verifier.rb  default,hs-default https://my.login.page/loginlogin
Starting verification of policies default, hs-default, hs-production:
	🛑 Invalid cookie config 'COOKIE_NAME':
 		👺   Cookie not secure.
😱  Failed !

Installation

Add this line to your application's Gemfile:

gem 'http-headers-verifier'

And then execute:

$ bundle

Or install it yourself as:

$ gem install http-headers-verifier

Configuration

Policy configuration is a series of YAML files, with the following naming convention: headers-rules-*.yml

Where * is the policy named to be used in the command line.

Configuration has the following YMAL blockes:

---
    headers:

    cookie_attr:

    ignored_headers:

    headers_to_avoid:

Example

Contributing

Bug reports and pull requests are welcome on GitHub at https://github.com/AvnerCohen/http-headers-verifier. This project is intended to be a safe, welcoming space for collaboration, and contributors are expected to adhere to the Contributor Covenant code of conduct.

License

The gem is available as open source under the terms of the MIT License.

Code of Conduct

Everyone interacting in the Http Headers Verifier project’s codebases, issue trackers, chat rooms and mailing lists is expected to follow the code of conduct.

About

Ruby gem to verify a pre-defined HTTP headers configurations.

Resources

License

Releases

No releases published

Packages

No packages published

Languages

You can’t perform that action at this time.