performing-security-headers-audit

执行安全标头审计

适用场景

• 在经授权的 Web 应用安全评估中，作为标准配置审查的一部分
• 评估针对 XSS、点击劫持和数据泄露的浏览器级防护
• 进行要求实施安全标头的合规性评估（PCI DSS、SOC 2）
• 执行初步侦察，以发现易于落实的安全改进
• 在 CI/CD 流水线中对新部署执行安全门禁检查

前提条件

• 授权：目标应用的书面授权范围（标头审查风险较低）
• curl：用于获取目标端点的响应标头
• SecurityHeaders.com：用于快速评估标头的在线扫描器
• Mozilla Observatory：Mozilla 的 Web 安全测试工具
• Burp Suite：用于跨多个页面进行全面的标头分析
• 浏览器 DevTools：用于实时检查标头和 CSP 违规情况

工作流

步骤 1：收集目标的安全标头

获取并整理所有与安全相关的响应标头。

# Fetch all response headers
curl -s -I "https://target.example.com/" | grep -iE \
  "(strict-transport|content-security|x-frame|x-content-type|x-xss|referrer-policy|permissions-policy|feature-policy|x-permitted|cross-origin|set-cookie|server|x-powered-by|cache-control)"

# Check headers across multiple pages
PAGES=("/" "/login" "/api/health" "/admin" "/account/settings" "/static/app.js")

for page in "${PAGES[@]}"; do
  echo "=== $page ==="
  curl -s -I "https://target.example.com$page" 2>/dev/null | grep -iE \
    "(strict-transport|content-security|x-frame|x-content-type|x-xss|referrer-policy|permissions-policy|set-cookie|server|x-powered)"
  echo
done

# Check both HTTP and HTTPS responses
echo "=== HTTP Response ==="
curl -s -I "http://target.example.com/" | head -20
echo "=== HTTPS Response ==="
curl -s -I "https://target.example.com/" | head -20

步骤 2：评估传输安全（HSTS）

评估 HTTP Strict Transport Security 配置。

# Check HSTS header
curl -s -I "https://target.example.com/" | grep -i "strict-transport-security"

# Expected: Strict-Transport-Security: max-age=31536000; includeSubDomains; preload

# Verify HSTS attributes:
# max-age: Should be >= 31536000 (1 year) for preload eligibility
# includeSubDomains: Protects all subdomains
# preload: Eligible for browser HSTS preload list

# Check if HTTP redirects to HTTPS
curl -s -I "http://target.example.com/" | head -5
# Should be 301/302 redirect to https://

# Check if HSTS is on the preload list
# Visit: https://hstspreload.org/?domain=target.example.com

# Test for HTTPS-only cookies
curl -s -I "https://target.example.com/login" | grep -i "set-cookie"
# All session cookies should have Secure flag

# Check for mixed content
curl -s "https://target.example.com/" | grep -oP "http://[^\"']+" | head -20
# HTTP resources loaded on HTTPS pages create mixed content vulnerabilities

步骤 3：审计内容安全策略（CSP）

分析 CSP 标头的有效性和潜在绕过方式。

# Extract CSP header
CSP=$(curl -s -I "https://target.example.com/" | grep -i "content-security-policy" | cut -d: -f2-)
echo "$CSP"

# Check for dangerous directives:
# 'unsafe-inline' in script-src: Allows inline scripts (XSS risk)
# 'unsafe-eval' in script-src: Allows eval() (XSS risk)
# * in any directive: Allows loading from any origin
# data: in script-src: Allows data: URI scripts
# Missing default-src: No fallback policy

echo "$CSP" | tr ';' '\n' | while read directive; do
  echo "  $directive"
  if echo "$directive" | grep -q "unsafe-inline"; then
    echo "    WARNING: unsafe-inline allows inline script execution"
  fi
  if echo "$directive" | grep -q "unsafe-eval"; then
    echo "    WARNING: unsafe-eval allows eval() calls"
  fi
  if echo "$directive" | grep -q " \* "; then
    echo "    WARNING: wildcard allows loading from any origin"
  fi
done

# Check for CSP report-only (not enforcing)
curl -s -I "https://target.example.com/" | grep -i "content-security-policy-report-only"
# Report-only does NOT block violations, only logs them

# Test CSP with Google's evaluator
# https://csp-evaluator.withgoogle.com/
# Paste the CSP header for automated analysis

# Check for CSP bypass via whitelisted domains
# If CDN domains are whitelisted, check for JSONP endpoints or angular libraries

步骤 4：检查框架保护和点击防护标头

验证防点击劫持和 iframe 嵌入控制。

# X-Frame-Options
curl -s -I "https://target.example.com/" | grep -i "x-frame-options"
# Expected: DENY or SAMEORIGIN
# ALLOW-FROM is deprecated and not supported in modern browsers

# CSP frame-ancestors (supersedes X-Frame-Options)
curl -s -I "https://target.example.com/" | grep -i "content-security-policy" | grep -o "frame-ancestors[^;]*"
# Expected: frame-ancestors 'none' or frame-ancestors 'self'

# X-Content-Type-Options
curl -s -I "https://target.example.com/" | grep -i "x-content-type-options"
# Expected: nosniff (prevents MIME type sniffing)

# X-XSS-Protection (legacy, but still useful for older browsers)
curl -s -I "https://target.example.com/" | grep -i "x-xss-protection"
# Expected: 1; mode=block (or 0 if CSP is comprehensive)
# Note: Modern recommendation is 0 (disable) when CSP is present

# Referrer-Policy
curl -s -I "https://target.example.com/" | grep -i "referrer-policy"
# Expected: strict-origin-when-cross-origin or no-referrer
# Prevents sensitive URL data from leaking via Referer header

步骤 5：审计 Cookie 安全属性

检查会话和身份验证 Cookie 的安全标记。

# Fetch all Set-Cookie headers
curl -s -I -L "https://target.example.com/login" | grep -i "set-cookie"

# Check each cookie for required attributes:
# Secure: Only sent over HTTPS
# HttpOnly: Not accessible via JavaScript (prevents XSS cookie theft)
# SameSite: Controls cross-site cookie sending (Strict, Lax, None)
# Path: Restricts cookie scope
# Domain: Controls which domains receive the cookie
# Max-Age/Expires: Cookie lifetime

# Automated cookie check
curl -s -I "https://target.example.com/login" | grep -i "set-cookie" | while read line; do
  echo "Cookie: $(echo "$line" | grep -oP '[^:]+=[^;]+')"
  missing=""
  echo "$line" | grep -qi "secure" || missing="$missing Secure"
  echo "$line" | grep -qi "httponly" || missing="$missing HttpOnly"
  echo "$line" | grep -qi "samesite" || missing="$missing SameSite"
  if [ -n "$missing" ]; then
    echo "  MISSING:$missing"
  else
    echo "  All flags present"
  fi
done

# Check for __Host- and __Secure- cookie prefixes
# __Host- cookies must have Secure, Path=/, no Domain
# __Secure- cookies must have Secure flag

步骤 6：检查 Permissions Policy 和信息泄露

检查浏览器功能控制和信息泄露标头。

# Permissions-Policy (formerly Feature-Policy)
curl -s -I "https://target.example.com/" | grep -i "permissions-policy"
# Controls browser features: camera, microphone, geolocation, etc.
# Expected: Restrict unused features
# Example: permissions-policy: camera=(), microphone=(), geolocation=()

# Cross-Origin headers
curl -s -I "https://target.example.com/" | grep -iE "(cross-origin-embedder|cross-origin-opener|cross-origin-resource)"
# COEP: Cross-Origin-Embedder-Policy: require-corp
# COOP: Cross-Origin-Opener-Policy: same-origin
# CORP: Cross-Origin-Resource-Policy: same-origin

# Information disclosure headers to flag
curl -s -I "https://target.example.com/" | grep -iE "(server|x-powered-by|x-aspnet|x-generator)"
# Server: Apache/2.4.52 (should be removed or generic)
# X-Powered-By: PHP/8.1.2 (should be removed)
# These headers reveal technology stack to attackers

# Cache-Control for sensitive pages
curl -s -I "https://target.example.com/account/settings" | grep -i "cache-control"
# Sensitive pages should have: Cache-Control: no-store, no-cache, must-revalidate
# Prevents browser caching of sensitive data

# Generate comprehensive report using online tools
echo "Scan with SecurityHeaders.com: https://securityheaders.com/?q=target.example.com"
echo "Scan with Mozilla Observatory: https://observatory.mozilla.org/analyze/target.example.com"

核心概念

概念	描述
HSTS	强制浏览器对该域名仅使用 HTTPS，防止协议降级攻击
CSP	限制页面可以加载的资源（脚本、样式、图像）
X-Frame-Options	控制页面是否可以嵌入 iframe（用于防御点击劫持）
X-Content-Type-Options	防止 MIME 类型嗅探；强制浏览器遵循声明的 Content-Type
Referrer-Policy	控制跨源请求中发送多少来源信息
Permissions-Policy	限制页面可用的浏览器功能（摄像头、麦克风、地理位置）
SameSite Cookie	控制 Cookie 在跨站上下文中何时发送（Strict、Lax、None）
HSTS 预加载	将 HSTS 策略硬编码到浏览器源代码中，以保护首次访问

工具与系统

工具	用途
SecurityHeaders.com	在线扫描器，提供安全标头的字母等级评估
Mozilla Observatory	提供评分和建议的综合 Web 安全扫描器
CSP Evaluator (Google)	分析 Content Security Policy 中的弱点和绕过方式
Burp Suite Professional	检查应用所有页面的响应标头
securityheaders (CLI)	命令行安全标头扫描器
Hardenize	TLS 和安全标头监控服务

常见场景

场景 1：完全缺少标头

旧版应用完全不返回安全标头。没有 HSTS、CSP、X-Frame-Options 或 Cookie 安全标记。每个页面都容易受到点击劫持攻击，浏览器层面没有针对 XSS 的缓解措施，而且 Cookie 会通过 HTTP 发送。

场景 2：包含 unsafe-inline 的弱 CSP

CSP 标头包含 script-src 'self' 'unsafe-inline'。虽然它限制了外部脚本加载，但 unsafe-inline 指令允许执行任意内联脚本，因此 CSP 无法有效防御 XSS。

场景 3：会话 Cookie 未设置 Secure 标记

会话 Cookie 未设置 Secure 标记。在混合使用 HTTP/HTTPS 的站点上，网络攻击者可以通过普通 HTTP 请求截获会话令牌。

场景 4：缺少 HSTS 导致 SSL 剥离攻击

未设置 HSTS 头。网络上的攻击者可以执行 SSL 剥离攻击，将受害者的 HTTPS 连接降级为 HTTP，并拦截所有流量。

输出格式

## Security Headers Audit Report

**Target**: target.example.com
**Grade**: D (SecurityHeaders.com)
**Assessment Date**: 2024-01-15

### Headers Assessment
| Header | Status | Current Value | Recommended |
|--------|--------|---------------|-------------|
| Strict-Transport-Security | MISSING | - | max-age=31536000; includeSubDomains; preload |
| Content-Security-Policy | WEAK | script-src 'self' 'unsafe-inline' | script-src 'self' 'nonce-{random}' |
| X-Frame-Options | MISSING | - | DENY |
| X-Content-Type-Options | PRESENT | nosniff | nosniff (OK) |
| Referrer-Policy | MISSING | - | strict-origin-when-cross-origin |
| Permissions-Policy | MISSING | - | camera=(), microphone=(), geolocation=() |
| X-XSS-Protection | MISSING | - | 0 (with strong CSP) |

### Cookie Security
| Cookie | Secure | HttpOnly | SameSite | Path |
|--------|--------|----------|----------|------|
| session | NO | YES | Not set | / |
| user_pref | NO | NO | Not set | / |
| csrf_token | YES | NO | Strict | / |

### Information Disclosure
| Header | Value | Risk |
|--------|-------|------|
| Server | Apache/2.4.52 | Technology fingerprinting |
| X-Powered-By | PHP/8.1.2 | Version-specific exploit targeting |

### Recommendation Priority
1. **Critical**: Add Secure and SameSite flags to session cookie
2. **High**: Implement HSTS with min 1-year max-age
3. **High**: Replace 'unsafe-inline' in CSP with nonce-based policy
4. **Medium**: Add X-Frame-Options: DENY
5. **Medium**: Add Referrer-Policy: strict-origin-when-cross-origin
6. **Low**: Remove Server and X-Powered-By version information
7. **Low**: Add Permissions-Policy to restrict unused browser features