CanuteTheGreat/http-header-auditor
Watch
1
0
Fork
You've already forked http-header-auditor
 0
Code Issues Pull requests Projects Releases 2 Packages Wiki Activity Actions
2 releases 4 tags
  • v1.2.1 1d8b55a6e7

    http-header-auditor v1.2.1
    Some checks failed
    tests / test (3.14) (push) Has been cancelled
    Details
    tests / test (3.8) (push) Has been cancelled
    Details
    release / release (push) Successful in 14s
    Details
    Stable

    Ghost released this 2026-10-17 01:50:05 -07:00 | 11 commits to master since this release

    • Scores now match the Mozilla HTTP Observatory table (checked on 18 header profiles): a CSP with unsafe-inline for styles only is no longer penalised as a script hole (it cost -20 and the grade), unsafe-eval alone is -10, a CSP without unsafe-* earns the +5/+10 bonus, cookies count their worst problem (session cookie without HttpOnly -30, without Secure -40, less under HSTS) instead of a capped sum.
    • Clickjacking: X-Frame-Options values other than DENY/SAMEORIGIN (browsers ignore them) and frame-ancestors * no longer count as protection.
    • Strict-Transport-Security: max-age=0 (HSTS switched off) is treated as no HSTS; an unrecognised Referrer-Policy value is flagged.
    • Session-cookie detection uses name words, not substrings: consider/author_pref are no longer "session cookies", and CSRF cookies (csrftoken, XSRF-TOKEN) that frameworks need scripts to read aren't flagged.
    • Tests: Observatory-table accuracy suite, mutation testing (nightly), claims ledger.

    Install

    pipx install git+https://git.canutethegreat.com/CanuteTheGreat/http-header-auditor.git@v1.2.1
# or the wheel attached to this release:
pipx install https://git.canutethegreat.com/CanuteTheGreat/http-header-auditor/releases/download/v1.2.1/http_header_auditor-1.2.1-py3-none-any.whl
# or the single file (stdlib-only Python 3):
curl -fsSLO https://git.canutethegreat.com/CanuteTheGreat/http-header-auditor/releases/download/v1.2.1/http_header_auditor.py

    SHA-256

    7288184b2c5ab4cda8b5548465d622cb1488fad61bb4ade2a29303e6e630acbc  http_header_auditor.py
2f4ba049242b952bc34247f2732b08b74d39b8d09415413a8fa4e6c9681c1764  http_header_auditor-1.2.1-py3-none-any.whl
e490915cb662595140ec8a23aceb85a1a65e55e4b48b9fd887b0ca9b68ff55e2  http_header_auditor-1.2.1.tar.gz
    Downloads