Security headers grader
Edit a real-looking HTTP response until it scores an A: HSTS, CSP, framing, cookies, CORS, and the version banners an attacker reads first.
Goal
This is the response from the account page of an internal Express app behind nginx, captured with curl -sI. It was deployed with framework defaults and a few headers copied from an old blog post.
Edit the headers in place. Every change is graded as you type against ten checks. The grade here is the lab’s own scale: A when every check passes, one letter lower for each failure.
- failStrict-Transport-Securitymax-age=300 is under one year (31536000).
- failContent-Security-Policy script sourcesscript sources include 'unsafe-inline'.
- failClickjacking protectionAdd CSP frame-ancestors 'none' (or 'self').
- failX-Content-Type-OptionsSet nosniff so browsers do not guess content types.
- failReferrer-PolicyMissing. Set strict-origin-when-cross-origin or stricter.
- failPermissions-PolicyMissing. Turn off features the site does not use, such as camera=(), microphone=(), geolocation=().
- failSession cookie attributessid is missing secure, SameSite=Lax or Strict.
- failCORS on this responseA wildcard origin with credentials is invalid and signals a misconfigured CORS layer. Drop both, or list exact origins.
- failVersion disclosureX-Powered-By: Express 4.17.1. Remove it.
- failLegacy X-XSS-ProtectionThe old browser XSS filter is gone, and where it existed it could be abused. Remove the header or set it to 0.
Steps
01Edit the response headers until the grade is A.
Do this in the workbench above. This step completes itself when the condition is met.
02Which response header names the application framework and its version?
03What is wrong with max-age=300 on HSTS?
04Why does the grader fail script-src with 'unsafe-inline'?
05The page now scores A. What does that prove?