skills.rest
riandeoliveira
riandeoliveiraCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

performing-security-headers-audit

Audit HTTP response headers for missing security protections and cookie attributes.

Updated Jan 29, 2024
Search Tags:#owasp#security headers#security audit#csp#hsts#web hardening#cookie security
One-click install
npx skills add https://github.com/riandeoliveira/aspnet-template --skill performing-security-headers-audit-riandeoliveira
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: performing-security-headers-audit
Source: https://github.com/riandeoliveira/aspnet-template/tree/main/.claude/skills/performing-security-headers-audit
Command: npx skills add https://github.com/riandeoliveira/aspnet-template --skill performing-security-headers-audit-riandeoliveira

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires requests, and includes scripts (resource) and references (resource) components.

What problem does it solve?

Detecting missing or weak HTTP security headers and cookie flags is hard to do consistently, and gaps can leave web apps exposed to XSS, clickjacking, downgrade attacks, and information leakage.

Core Features & Use Cases

  • Security header auditing: Checks for HSTS, CSP, X-Frame-Options/frame-ancestors, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy across target pages.
  • Cookie attribute verification: Reviews cookies for Secure, HttpOnly, and SameSite settings and flags unsafe patterns.
  • Information disclosure review: Detects stack/version-leaking headers such as Server and X-Powered-By and recommends genericization.
  • Use Case: Run an authorized assessment for a production or staging domain, prioritize fixes (critical/high/medium), and produce an actionable hardening checklist for developers and security teams.

Quick Start

Run the audit agent against your domain, e.g., agent.py https://target.example.com /,/login,/admin to generate a security headers report with a grade and prioritized recommendations.

Frequently Asked Questions about performing-security-headers-audit

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I audit HTTP security headers for missing HSTS and CSP configurations?▼

Auditing HTTP security headers requires collecting response headers via HTTP requests and evaluating HSTS, CSP, X-Frame-Options, and related directives to identify missing browser protections. This Skill automates that collection and evaluation across target endpoints to produce a structured JSON findings report.

How can I check cookie security flags like Secure, HttpOnly, and SameSite automatically?▼

Checking cookie security flags involves inspecting Set-Cookie attributes for Secure, HttpOnly, and SameSite settings. This Skill performs cookie attribute verification during authorized web application security assessments and flags unsafe patterns in a structured report.

What is the best way to scan for information disclosure headers like Server and X-Powered-By?▼

Scanning for information disclosure headers detects stack and version-leaking headers such as Server and X-Powered-By. This Skill reviews HTTP responses to identify these headers and recommends genericization to prevent information leakage.

Can I run a security headers audit for CI/CD header gate checks across multiple endpoints?▼

Running a security headers audit for CI/CD header gate checks is supported across key endpoints. You provide the target domain and specific paths, and the Skill evaluates the HTTP response headers to generate an overall grade and prioritized recommendations.

Do I need the requests library to perform a web hardening security audit?▼

Yes, the requests library is required as a dependency to perform this web hardening security audit. It is used to collect the HTTP response headers from your target URLs for evaluation.

Why does my web application security assessment report an overall grade for missing headers?▼

A web application security assessment assigns an overall grade by evaluating missing or misconfigured browser security protections against known risks like XSS and clickjacking. The resulting JSON findings report includes severity levels to prioritize fixes.

Related Skills

Explore More Legal & Compliance Skills→
dapperdiversdapperdivers
1

header-analysis

Audit HTTP response headers and cookie attributes for missing security controls.

Community
Intermediate
iamtatsuki05iamtatsuki05

security-check

Scan codebases for secrets, injections, auth flaws, and dependency vulnerabilities.

Community
Advanced
linardsblinardsb

security-engineering

Assess vulnerabilities and verify compliance across cloud and application systems.

Community
Advanced
Sir-chawakornSir-chawakorn
9

configure-security-headers-csp

Configure HTTP security headers and strict nonce-based Content-Security-Policy directives.

Community
Advanced