New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

WSTG-CONF-14 #1185

Open

websecnl wants to merge 43 commits into OWASP:master from websecnl:master

websecnl commented Feb 5, 2025 •

edited by kingthorin

Loading

This PR fixes #1172.

This PR handles the issue and requires no additional PRs.
You have validated the need for this change.

What did this PR accomplish?

Added WSTG-CONF-14 which covers Misconfiguration in HTTP Security Headers, mainly the following:

Security Header with a Empty Value
Security Header with an invalid value or name (Typos)
Overpermissive Security Headers (Allow-Credentials, *)
Duplicate Security Headers
Legacy Security Headers (which are no longer supported such as HPKP)

websecnl added 5 commits

February 5, 2025 01:02


          Create 14-test_other_http_security_header_misconfigurations.md

1567dae


          Update README.md

8bf1b66


          Rename 14-test_other_http_security_header_misconfigurations.md to 14-…

29554cf

…Test_Other_Http_Security_Header_Misconfigurations.md


          Rename 14-Test_Other_Http_Security_Header_Misconfigurations.md to 14-…

…Test_Other_HTTP_Security_Header_Misconfigurations.md


          Update 14-Test_Other_HTTP_Security_Header_Misconfigurations.md

18a909a

kingthorin reviewed

View reviewed changes

Collaborator

kingthorin left a comment

Is it worth adding a note about META tag handling/mistakes? What about duplicate or invalid directives within the header value(s)? (Ex: In CSP, etc)

...eb_Application_Security_Testing/02-Configuration_and_Deployment_Management_Testing/README.md Show resolved Hide resolved

...on_and_Deployment_Management_Testing/14-Test_Other_HTTP_Security_Header_Misconfigurations.md Outdated Show resolved Hide resolved

...on_and_Deployment_Management_Testing/14-Test_Other_HTTP_Security_Header_Misconfigurations.md Outdated Show resolved Hide resolved

...on_and_Deployment_Management_Testing/14-Test_Other_HTTP_Security_Header_Misconfigurations.md Outdated Show resolved Hide resolved

...on_and_Deployment_Management_Testing/14-Test_Other_HTTP_Security_Header_Misconfigurations.md Outdated Show resolved Hide resolved

...on_and_Deployment_Management_Testing/14-Test_Other_HTTP_Security_Header_Misconfigurations.md Outdated Show resolved Hide resolved

...on_and_Deployment_Management_Testing/14-Test_Other_HTTP_Security_Header_Misconfigurations.md Outdated Show resolved Hide resolved

...on_and_Deployment_Management_Testing/14-Test_Other_HTTP_Security_Header_Misconfigurations.md Outdated Show resolved Hide resolved

...on_and_Deployment_Management_Testing/14-Test_Other_HTTP_Security_Header_Misconfigurations.md Outdated Show resolved Hide resolved

...on_and_Deployment_Management_Testing/14-Test_Other_HTTP_Security_Header_Misconfigurations.md Outdated Show resolved Hide resolved

This comment was marked as outdated.

Sign in to view

websecnl and others added 16 commits

February 5, 2025 18:53


          Update document/4-Web_Application_Security_Testing/02-Configuration_a…

fa6f6b8

…nd_Deployment_Management_Testing/14-Test_Other_HTTP_Security_Header_Misconfigurations.md

Co-authored-by: Rick M <kingthorin@users.noreply.github.com>


          Update document/4-Web_Application_Security_Testing/02-Configuration_a…

7f76e66

…nd_Deployment_Management_Testing/14-Test_Other_HTTP_Security_Header_Misconfigurations.md

Co-authored-by: Rick M <kingthorin@users.noreply.github.com>


          Update document/4-Web_Application_Security_Testing/02-Configuration_a…

b49842e

…nd_Deployment_Management_Testing/14-Test_Other_HTTP_Security_Header_Misconfigurations.md

Co-authored-by: Rick M <kingthorin@users.noreply.github.com>


          Update document/4-Web_Application_Security_Testing/02-Configuration_a…

a6c13ca

…nd_Deployment_Management_Testing/14-Test_Other_HTTP_Security_Header_Misconfigurations.md

Co-authored-by: Rick M <kingthorin@users.noreply.github.com>


          Update document/4-Web_Application_Security_Testing/02-Configuration_a…

a984fa1

…nd_Deployment_Management_Testing/14-Test_Other_HTTP_Security_Header_Misconfigurations.md

Co-authored-by: Rick M <kingthorin@users.noreply.github.com>


          Update document/4-Web_Application_Security_Testing/02-Configuration_a…

8d45182

…nd_Deployment_Management_Testing/14-Test_Other_HTTP_Security_Header_Misconfigurations.md

Co-authored-by: Rick M <kingthorin@users.noreply.github.com>


          Update document/4-Web_Application_Security_Testing/02-Configuration_a…

eea1f40

…nd_Deployment_Management_Testing/14-Test_Other_HTTP_Security_Header_Misconfigurations.md

Co-authored-by: Rick M <kingthorin@users.noreply.github.com>


          Update document/4-Web_Application_Security_Testing/02-Configuration_a…

ab20e9e

…nd_Deployment_Management_Testing/14-Test_Other_HTTP_Security_Header_Misconfigurations.md

Co-authored-by: Rick M <kingthorin@users.noreply.github.com>


          Update document/4-Web_Application_Security_Testing/02-Configuration_a…

ec7e77b

…nd_Deployment_Management_Testing/14-Test_Other_HTTP_Security_Header_Misconfigurations.md

Co-authored-by: Rick M <kingthorin@users.noreply.github.com>


          Update document/4-Web_Application_Security_Testing/02-Configuration_a…

65db337

…nd_Deployment_Management_Testing/14-Test_Other_HTTP_Security_Header_Misconfigurations.md

Co-authored-by: Rick M <kingthorin@users.noreply.github.com>


          Update document/4-Web_Application_Security_Testing/02-Configuration_a…

51e94a4

…nd_Deployment_Management_Testing/14-Test_Other_HTTP_Security_Header_Misconfigurations.md

Co-authored-by: Rick M <kingthorin@users.noreply.github.com>


          Update document/4-Web_Application_Security_Testing/02-Configuration_a…

c009355

…nd_Deployment_Management_Testing/14-Test_Other_HTTP_Security_Header_Misconfigurations.md

Co-authored-by: Rick M <kingthorin@users.noreply.github.com>


          Update document/4-Web_Application_Security_Testing/02-Configuration_a…

df63f76

…nd_Deployment_Management_Testing/14-Test_Other_HTTP_Security_Header_Misconfigurations.md

Co-authored-by: Rick M <kingthorin@users.noreply.github.com>


          Update 14-Test_Other_HTTP_Security_Header_Misconfigurations.md

58a3eea


          Update 14-Test_Other_HTTP_Security_Header_Misconfigurations.md

b09726a


          Update 14-Test_Other_HTTP_Security_Header_Misconfigurations.md

16640c8

This comment was marked as resolved.

Sign in to view

kingthorin reviewed

View reviewed changes

...on_and_Deployment_Management_Testing/14-Test_Other_HTTP_Security_Header_Misconfigurations.md Outdated Show resolved Hide resolved


          Update document/4-Web_Application_Security_Testing/02-Configuration_a…

e6d3138

…nd_Deployment_Management_Testing/14-Test_Other_HTTP_Security_Header_Misconfigurations.md

Co-authored-by: Rick M <kingthorin@users.noreply.github.com>

Author

websecnl commented Feb 8, 2025

Is it worth adding a note about META tag handling/mistakes? What about duplicate or invalid directives within the header value(s)? (Ex: In CSP, etc)

As for invalid directives this has already been added.

Aren't META-tags not really related to Headers, please correct me if i'm wrong?


          Update 14-Test_Other_HTTP_Security_Header_Misconfigurations.md

1c366b4

Moved Test Objectives before Common Security Header Misconfigurations

Collaborator

kingthorin commented Feb 8, 2025

There are a number of headers or header behaviours that can be implemented as http-equiv meta tags. Similarly there are some headers/directives that specifically cannot be used in metas.

That being said now that you have me writing this I think we have another section in info leaks via metas so it could also be mentioned there.

Author

websecnl commented Feb 8, 2025

That being said now that you have me writing this I think we have another section in info leaks via metas so it could also be mentioned there.

Ah the meta http-equiv , Gotcha.
No, I think you are right and these should be mentioned in this.

I will update the text and give you another message once i wrote about it, this makes sense.

Thanks for mentioning it!

websecnl added 3 commits

February 24, 2025 10:38


          Update 14-Test_Other_HTTP_Security_Header_Misconfigurations.md

b7d412d


          Update 14-Test_Other_HTTP_Security_Header_Misconfigurations.md

d012a34


          Update 14-Test_Other_HTTP_Security_Header_Misconfigurations.md

96846b6

kingthorin reviewed

View reviewed changes

...on_and_Deployment_Management_Testing/14-Test_Other_HTTP_Security_Header_Misconfigurations.md Outdated Show resolved Hide resolved


          Update document/4-Web_Application_Security_Testing/02-Configuration_a…

b8ff726

…nd_Deployment_Management_Testing/14-Test_Other_HTTP_Security_Header_Misconfigurations.md

kingthorin reviewed

View reviewed changes

...on_and_Deployment_Management_Testing/14-Test_Other_HTTP_Security_Header_Misconfigurations.md Outdated Show resolved Hide resolved


          Update document/4-Web_Application_Security_Testing/02-Configuration_a…

17e07ca

…nd_Deployment_Management_Testing/14-Test_Other_HTTP_Security_Header_Misconfigurations.md

kingthorin reviewed

View reviewed changes

...on_and_Deployment_Management_Testing/14-Test_Other_HTTP_Security_Header_Misconfigurations.md Outdated Show resolved Hide resolved


          Update document/4-Web_Application_Security_Testing/02-Configuration_a…

cf5d8eb

…nd_Deployment_Management_Testing/14-Test_Other_HTTP_Security_Header_Misconfigurations.md

kingthorin reviewed

View reviewed changes

...on_and_Deployment_Management_Testing/14-Test_Other_HTTP_Security_Header_Misconfigurations.md Outdated Show resolved Hide resolved


          Update document/4-Web_Application_Security_Testing/02-Configuration_a…

0e89b64

…nd_Deployment_Management_Testing/14-Test_Other_HTTP_Security_Header_Misconfigurations.md

kingthorin reviewed

View reviewed changes

...on_and_Deployment_Management_Testing/14-Test_Other_HTTP_Security_Header_Misconfigurations.md Outdated Show resolved Hide resolved


          Update document/4-Web_Application_Security_Testing/02-Configuration_a…

9b5197d

…nd_Deployment_Management_Testing/14-Test_Other_HTTP_Security_Header_Misconfigurations.md

kingthorin reviewed

View reviewed changes

...on_and_Deployment_Management_Testing/14-Test_Other_HTTP_Security_Header_Misconfigurations.md Outdated Show resolved Hide resolved


          Update document/4-Web_Application_Security_Testing/02-Configuration_a…

407b4af

…nd_Deployment_Management_Testing/14-Test_Other_HTTP_Security_Header_Misconfigurations.md

kingthorin reviewed

View reviewed changes

...on_and_Deployment_Management_Testing/14-Test_Other_HTTP_Security_Header_Misconfigurations.md Outdated Show resolved Hide resolved

kingthorin reviewed

View reviewed changes

...on_and_Deployment_Management_Testing/14-Test_Other_HTTP_Security_Header_Misconfigurations.md Outdated Show resolved Hide resolved

kingthorin reviewed

View reviewed changes

...on_and_Deployment_Management_Testing/14-Test_Other_HTTP_Security_Header_Misconfigurations.md Outdated Show resolved Hide resolved


          Apply suggestions from code review

c5d6ebd

kingthorin reviewed

View reviewed changes

...on_and_Deployment_Management_Testing/14-Test_Other_HTTP_Security_Header_Misconfigurations.md Outdated Show resolved Hide resolved

kingthorin added 3 commits

February 24, 2025 06:06


          Update document/4-Web_Application_Security_Testing/02-Configuration_a…

076e170

…nd_Deployment_Management_Testing/14-Test_Other_HTTP_Security_Header_Misconfigurations.md


          Update 14-Test_Other_HTTP_Security_Header_Misconfigurations.md


          Update 14-Test_Other_HTTP_Security_Header_Misconfigurations.md

c18a6bf

This comment was marked as outdated.

Sign in to view


          Update 14-Test_Other_HTTP_Security_Header_Misconfigurations.md

be7e4c3

This comment was marked as resolved.

Sign in to view


          Update 14-Test_Other_HTTP_Security_Header_Misconfigurations.md

60d4d32

This comment was marked as resolved.

Sign in to view


          Update 14-Test_Other_HTTP_Security_Header_Misconfigurations.md

68a6f79

Collaborator

kingthorin commented Feb 24, 2025 •

edited

Loading

Okay all the linting etc is finally fixed. Thanks lease make sure I don’t accidentally remove any content (I had dropped a paragraph at one point , though I think that was an issue with GitHub parsing suggestions that contain code blocks).

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet