Skip to content

Fixed bug for x-frame-options header #1

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
r--w wants to merge 2 commits into
base: gh-pages
Choose a base branch
from
Open

Fixed bug for x-frame-options header #1

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
2cc892a
Fixed bug for x-frame-options header
r--w Oct 14, 2015
bd4e7d8
Changed X-Content-Security-Policy into Content-Security-Policy
r--w Dec 29, 2015
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions gethead.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -60,7 +60,7 @@ def printout(text, colour=WHITE):
printout('- Server does not enforce Cross-Site Scripting Protection.\nThe X-XSS-Protection Header setting is either inadequate or missing.\nClient may be vulnerable to Cross-Site Scripting Attacks.\n\n', WHITE)

# check x-frame-options:
if response.info().getheader('x-frame-options') == 'deny' or 'sameorigin':
if response.info().getheader('x-frame-options') and response.info().getheader('x-frame-options').lower() in ['deny', 'sameorigin']:
printout('(X-Frame-Options) Cross-Frame Scripting Protection is enforced.\n\n', GREEN)
else:
printout('Vulnerability ', RED)
Expand All @@ -81,8 +81,8 @@ def printout(text, colour=WHITE):
printout('- Server does not enforce HTTP over TLS/SSL Connections.\nThe Strict-Transport-Security Header setting is either inadequate or missing.\nClient may be vulnerable to Session Information Leakage.\n\n', WHITE)

# check x-content-security-policy:
if response.info().getheader('x-content-security-policy'):
printout('(X-Content-Security-Policy) Content Security Policy is enforced.\n\n', GREEN)
if response.info().getheader('content-security-policy'):
printout('(Content-Security-Policy) Content Security Policy is enforced.\n\n', GREEN)
else:
printout('Vulnerability ', RED)
printout('- Server does not enforce a Content Security Policy.\nThe X-Content-Security-Policy Header setting is either inadequate or missing.\nClient may be vulnerable to Cross-Site Scripting and Injection Attacks.\n\n', WHITE)
Expand Down