Security Test: Header leak¶

Description¶

Default Severity: low

When a web server gives away details about its inner workings in its HTTP headers, it offers a roadmap for attackers. Essentially, key information like which server or framework is in use can inadvertently help hackers target known weaknesses in those technologies. Developers often overlook default settings that automatically include this data or forget to remove it during deployment, which can leave the application more vulnerable to tailored attacks if an issue arises later on.

Reference:

• https://owasp.org/www-community/Security_Headers
  • https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html#web-content-caching
  • https://owasp.org/www-project-web-security-testing-guide/v41/4-Web_Application_Security_Testing/06-Session_Management_Testing/02-Testing_for_Cookies_Attributes.html

Configuration¶

Identifier: protocol/header_leak

Examples¶

All configuration available:

checks:
  protocol/header_leak:
    skip: false # default

Compliance and Standards¶