|
1 | 1 | # Security Header Analyzer |
2 | 2 |
|
3 | | -A lightweight Python CLI tool that fetches and analyzes HTTP security headers according to Mozilla and OWASP best practices. This tool is designed for developers, penetration testers, and system administrators who want a quick, reliable way to evaluate the security posture of a website’s HTTP response headers. |
| 3 | +[](https://www.python.org/downloads/) |
| 4 | +[](https://github.com/itheCreator1/security-header-analyzer/actions) |
| 5 | +[](https://github.com/itheCreator1/security-header-analyzer) |
| 6 | +[](LICENSE) |
| 7 | + |
| 8 | +A lightweight Python CLI tool that fetches and analyzes HTTP security headers according to Mozilla and OWASP best practices. This tool is designed for developers, penetration testers, and system administrators who want a quick, reliable way to evaluate the security posture of a website's HTTP response headers. |
4 | 9 |
|
5 | 10 | ## 🚀 Features |
6 | 11 |
|
7 | | -* Fetches HTTP response headers from a target URL |
8 | | -* Analyzes security-related headers: |
9 | | - |
10 | | - * Strict-Transport-Security (HSTS) |
11 | | - * Content-Security-Policy (CSP) |
12 | | - * X-Frame-Options |
13 | | - * X-Content-Type-Options |
14 | | - * Referrer-Policy |
15 | | -* Provides categorized findings: **Critical**, **High**, **Medium**, **Low** |
16 | | -* JSON output option for automation pipelines |
17 | | -* Custom User-Agent support |
18 | | -* Optional redirect blocking |
19 | | -* Timeout and error handling |
20 | | -* Clean, structured terminal reports |
| 12 | +* **9 Security Header Analyzers**: HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, COEP, COOP, CORP |
| 13 | +* **SSRF Protection**: Built-in safeguards against Server-Side Request Forgery attacks |
| 14 | +* **Multiple Output Formats**: Human-readable text or JSON for automation |
| 15 | +* **Severity Classification**: Issues categorized as Critical, High, Medium, or Low |
| 16 | +* **96% Test Coverage**: 291 comprehensive tests ensuring reliability |
| 17 | +* **Type Safety**: Full type hints with mypy support |
| 18 | +* **CI/CD Ready**: Easy integration with GitHub Actions, GitLab CI, Jenkins |
| 19 | +* **Extensible**: Add new header analyzers with minimal code changes |
21 | 20 |
|
22 | 21 | ## 📦 Installation |
23 | 22 |
|
@@ -55,34 +54,113 @@ python -m sha https://example.com |
55 | 54 | --debug Shows verbose debug logs |
56 | 55 | ``` |
57 | 56 |
|
| 57 | +## 📖 Documentation |
| 58 | + |
| 59 | +- **[Architecture Guide](docs/ARCHITECTURE.md)** - System design, components, and extensibility |
| 60 | +- **[API Documentation](docs/API.md)** - Library usage and programmatic access |
| 61 | +- **[Analyzer Reference](docs/ANALYZERS.md)** - Detailed header analysis specifications |
| 62 | +- **[Testing Guide](docs/TESTING.md)** - Running and writing tests |
| 63 | +- **[Deployment Guide](docs/DEPLOYMENT.md)** - CI/CD integration and production deployment |
| 64 | +- **[Contributing](CONTRIBUTING.md)** - Development workflow and guidelines |
| 65 | +- **[Security Policy](SECURITY.md)** - Vulnerability reporting and security considerations |
| 66 | +- **[Changelog](CHANGELOG.md)** - Version history and release notes |
| 67 | + |
58 | 68 | ## 📁 Project Structure |
59 | 69 |
|
60 | 70 | ``` |
61 | 71 | security-header-analyzer/ |
62 | 72 | ├── sha/ # Main package |
63 | | -│ ├── cli.py # CLI entry point |
64 | | -│ ├── fetcher.py # HTTP fetching logic |
65 | | -│ ├── analyzer.py # Header analysis engine |
66 | | -│ ├── reporter.py # Formatting and reporting |
67 | | -│ └── headers/ # Individual header analyzers |
68 | | -└── tests/ # Unit tests (~96% coverage) |
| 73 | +│ ├── __init__.py # Package initialization |
| 74 | +│ ├── __main__.py # Module entry point |
| 75 | +│ ├── main.py # CLI entry point |
| 76 | +│ ├── fetcher.py # HTTP header fetching with SSRF protection |
| 77 | +│ ├── analyzer.py # Analysis orchestration |
| 78 | +│ ├── reporter.py # Report generation (text/JSON) |
| 79 | +│ ├── config.py # Configuration and exceptions |
| 80 | +│ └── analyzers/ # Individual header analyzers (9 total) |
| 81 | +├── tests/ # Comprehensive test suite (291 tests, 96% coverage) |
| 82 | +├── docs/ # Documentation |
| 83 | +└── .github/ # CI/CD workflows |
| 84 | +``` |
| 85 | + |
| 86 | +## 💻 Library Usage |
| 87 | + |
| 88 | +Use as a Python library in your own code: |
| 89 | + |
| 90 | +```python |
| 91 | +from sha.fetcher import fetch_headers |
| 92 | +from sha.analyzer import analyze_headers |
| 93 | +from sha.reporter import generate_report |
| 94 | + |
| 95 | +# Fetch and analyze |
| 96 | +headers = fetch_headers("https://example.com") |
| 97 | +findings = analyze_headers(headers) |
| 98 | + |
| 99 | +# Generate report |
| 100 | +report = generate_report(findings, url="https://example.com", format="json") |
| 101 | +print(report) |
69 | 102 | ``` |
70 | 103 |
|
| 104 | +See [API Documentation](docs/API.md) for complete reference. |
| 105 | + |
71 | 106 | ## 🛡 Security Notes |
72 | 107 |
|
73 | 108 | The analyzer follows guidance from: |
74 | 109 |
|
75 | 110 | * **Mozilla Web Security Guidelines** |
76 | 111 | * **OWASP Secure Headers Project** |
77 | 112 |
|
78 | | -While it includes basic SSRF protections, DNS rebinding and TOCTOU-style attacks may bypass certain checks. Do not expose this tool as a public API without additional safety measures. |
| 113 | +**Security Features:** |
| 114 | +- SSRF protection against private IP ranges |
| 115 | +- DNS rebinding validation |
| 116 | +- SSL/TLS certificate verification |
| 117 | + |
| 118 | +**Known Limitations:** |
| 119 | +- TOCTOU vulnerability in DNS resolution (documented in [SECURITY.md](SECURITY.md)) |
| 120 | +- Do not expose as public API without additional safety measures |
79 | 121 |
|
80 | 122 | ## 🧪 Running Tests |
81 | 123 |
|
82 | | -``` |
| 124 | +```bash |
| 125 | +# Run all tests |
83 | 126 | pytest |
| 127 | + |
| 128 | +# With coverage |
| 129 | +pytest --cov=sha --cov-report=html |
| 130 | + |
| 131 | +# Run specific test |
| 132 | +pytest tests/test_hsts.py -v |
84 | 133 | ``` |
85 | 134 |
|
| 135 | +See [Testing Guide](docs/TESTING.md) for details. |
| 136 | + |
| 137 | +## 🤝 Contributing |
| 138 | + |
| 139 | +Contributions are welcome! Please read [CONTRIBUTING.md](CONTRIBUTING.md) for: |
| 140 | +- Development setup |
| 141 | +- Coding standards |
| 142 | +- Testing requirements |
| 143 | +- Pull request process |
| 144 | + |
| 145 | +## 📊 Project Status |
| 146 | + |
| 147 | +- **Version**: 1.0.0 |
| 148 | +- **Python**: 3.8, 3.9, 3.10, 3.11, 3.12 |
| 149 | +- **Tests**: 291 passing |
| 150 | +- **Coverage**: 96% |
| 151 | +- **License**: MIT |
| 152 | + |
| 153 | +## 🔗 Links |
| 154 | + |
| 155 | +- [GitHub Repository](https://github.com/itheCreator1/security-header-analyzer) |
| 156 | +- [Issue Tracker](https://github.com/itheCreator1/security-header-analyzer/issues) |
| 157 | +- [Security Policy](SECURITY.md) |
| 158 | +- [Changelog](CHANGELOG.md) |
| 159 | + |
86 | 160 | ## 📄 License |
87 | 161 |
|
88 | | -MIT License |
| 162 | +MIT License - See [LICENSE](LICENSE) for details |
| 163 | + |
| 164 | +--- |
| 165 | + |
| 166 | +**Made with security in mind** 🔒 |
0 commit comments