2 releases 4 tags

RSS feed

• v1.2.1 1d8b55a6e7

  Compare

  http-header-auditor v1.2.1 Stable

  Ghost released this 2026-10-17 01:50:05 -07:00 | 11 commits to master since this release

  • Scores now match the Mozilla HTTP Observatory table (checked on 18 header profiles): a CSP with unsafe-inline for styles only is no longer penalised as a script hole (it cost -20 and the grade), unsafe-eval alone is -10, a CSP without unsafe-* earns the +5/+10 bonus, cookies count their worst problem (session cookie without HttpOnly -30, without Secure -40, less under HSTS) instead of a capped sum.
  • Clickjacking: X-Frame-Options values other than DENY/SAMEORIGIN (browsers ignore them) and frame-ancestors * no longer count as protection.
  • Strict-Transport-Security: max-age=0 (HSTS switched off) is treated as no HSTS; an unrecognised Referrer-Policy value is flagged.
  • Session-cookie detection uses name words, not substrings: consider/author_pref are no longer "session cookies", and CSRF cookies (csrftoken, XSRF-TOKEN) that frameworks need scripts to read aren't flagged.
  • Tests: Observatory-table accuracy suite, mutation testing (nightly), claims ledger.

  Install

  pipx install git+https://git.canutethegreat.com/CanuteTheGreat/http-header-auditor.git@v1.2.1
  # or the wheel attached to this release:
  pipx install https://git.canutethegreat.com/CanuteTheGreat/http-header-auditor/releases/download/v1.2.1/http_header_auditor-1.2.1-py3-none-any.whl
  # or the single file (stdlib-only Python 3):
  curl -fsSLO https://git.canutethegreat.com/CanuteTheGreat/http-header-auditor/releases/download/v1.2.1/http_header_auditor.py
  

  SHA-256

  7288184b2c5ab4cda8b5548465d622cb1488fad61bb4ade2a29303e6e630acbc  http_header_auditor.py
  2f4ba049242b952bc34247f2732b08b74d39b8d09415413a8fa4e6c9681c1764  http_header_auditor-1.2.1-py3-none-any.whl
  e490915cb662595140ec8a23aceb85a1a65e55e4b48b9fd887b0ca9b68ff55e2  http_header_auditor-1.2.1.tar.gz
  

  Downloads

  • http_header_auditor-1.2.1-py3-none-any.whl
    14 downloads · 2026-10-17 03:23:00 -07:00 · 13 KiB
  • http_header_auditor-1.2.1.tar.gz
    15 downloads · 2026-10-17 03:23:00 -07:00 · 24 KiB
  • http_header_auditor.py
    13 downloads · 2026-10-17 03:22:59 -07:00 · 27 KiB
  • SHA256SUMS
    13 downloads · 2026-10-17 03:23:00 -07:00 · 297 B

  ---

  • Source code (ZIP)
    10 downloads
  • Source code (TAR.GZ)
    13 downloads
• v1.2.0 268cf149ae

  Compare

  http-header-auditor v1.2.0 Stable

  Ghost released this 2026-10-16 19:57:45 -07:00 | 17 commits to master since this release

  • Score and grade (A+ to F) in the style of the Mozilla HTTP Observatory, with --fail-on-grade.
  • New checks: HSTS preload-list eligibility, cookie __Host-/__Secure- prefix rules and script-readable
    session cookies, CORS (an Access-Control-Allow-Origin echoing any origin, with or without credentials),
    Cross-Origin-Opener/Embedder/Resource-Policy, Subresource Integrity on cross-origin scripts/stylesheets,
    Referrer-Policy strength, and the redirect chain (first hop must be HTTPS on the same host).
  • Exit codes now follow the shared convention: --fail-on (default missing) makes MISSING/FAIL
    checks exit 1, and an unreachable target exits 2. 1.x exited 0 unless a --fail-on-* flag was given;
    pass --fail-on never for the old behaviour.
  • Installable as a package: pipx install git+https://git.canutethegreat.com/CanuteTheGreat/http-header-auditor.git
    puts a http-header-auditor command on PATH (pyproject.toml, MIT license metadata).
  • --version flag.
  • Exit codes follow the shared convention: 0 = clean, 1 = findings at/above the gate, 2 = error or bad usage.
  • Every tag now publishes a Forgejo release with this changelog, the wheel, the sdist and SHA256SUMS.
  • CI installs the package with pip in a clean venv and checks --version/--help on every push.

  Install

  pipx install git+https://git.canutethegreat.com/CanuteTheGreat/http-header-auditor.git@v1.2.0
  # or the wheel attached to this release:
  pipx install https://git.canutethegreat.com/CanuteTheGreat/http-header-auditor/releases/download/v1.2.0/http_header_auditor-1.2.0-py3-none-any.whl
  # or the single file (stdlib-only Python 3):
  curl -fsSLO https://git.canutethegreat.com/CanuteTheGreat/http-header-auditor/releases/download/v1.2.0/http_header_auditor.py
  

  SHA-256

  09d436aceda87e7675597684402b481f3159ca232872a55e73fafe1cf5e7bab1  http_header_auditor.py
  a6e4dba875c30d1999b506911f3ccf023c6ad18afe32ec7c68e4511e6e68576f  http_header_auditor-1.2.0-py3-none-any.whl
  80a148d2a05da810918260f05b47fbfa05478b91e0aed5527f61c44a298c66c9  http_header_auditor-1.2.0.tar.gz
  

  Downloads

  • http_header_auditor-1.2.0-py3-none-any.whl
    6 downloads · 2026-10-16 19:58:14 -07:00 · 11 KiB
  • http_header_auditor-1.2.0.tar.gz
    5 downloads · 2026-10-16 19:58:15 -07:00 · 15 KiB
  • http_header_auditor.py
    5 downloads · 2026-10-16 19:58:14 -07:00 · 22 KiB
  • SHA256SUMS
    6 downloads · 2026-10-16 19:58:16 -07:00 · 297 B

  ---

  • Source code (ZIP)
    4 downloads
  • Source code (TAR.GZ)
    7 downloads