Growing together!

[rfc-st]

What is 'humble' missing?; being reasonable :):

• What HTTP header checks do you miss?.
• What totals do you think should be reported?.
• What results export format do you need and why?.

Let's use this issue to talk about the shortcomings of 'humble' (without preventing specific issues to be created for specific topics), ideas to make it more interesting and accessible for everyone. With total freedom and regardless of your technical knowledge,

I have the healthy habit of thanking all the contributions that result in an improvement of this tool: https://github.com/rfc-st/humble/?tab=readme-ov-file#acknowledgements .

Thanks for your time!.

[jdelamo3]

it would be a good idea to register a Humble formula in HomeBrew, which is one of the most popular package managers for macOSX and Linux, and which also greatly simplifies the compilation and installation of libraries and dependencies.
https://brew.sh

[rfc-st]

Hi, @jdelamo3

I have “zero” experience in the macOS and HomeBrew worlds :); but I promise to take a look and see what the process is like.

Regards,

[rfc-st]

Hi, @jdelamo3

Reviewing the necessary steps to make your suggestion possible ... we will keep in touch.

Best regards,

[cr4zyfish]

check for security headers via meta tags.
Deprecated HTTP Response Headers/Protocols and Insecure Values ====> separate these results

in this report for Deprecated HTTP Response Headers/Protocols and Insecure Values the value from server response is Deny so only the advice should be printed.

 X-Frame-Options (Incorrect Values)
 The only values allowed for this header are 'DENY' or 'SAMEORIGIN'.
 Advice: Replace this header with the CSP 'frame-ancestors' directive.
 Ref: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options

[rfc-st]

Hello, @cr4zyfish

Good suggestions, thanks!. I will take them into account.

• Regarding the first one, it seems (https://developer.mozilla.org/en-US/docs/Web/HTML/Element/meta#http-equiv) that the definition of attributes associated with HTTP directives would really be limited to three of them, at the security level: 'content-security-policy', 'content-type' and 'x-ua-compatible' ... at the HTTP response header level 'humble' has checks for all three ... I have to evaluate whether it is worth retrieving and parsing the response body for those meta directives with the added parsing time that might entail.

• Regarding separating the results of “Deprecated HTTP Response Headers/Protocols and Insecure Values” require modifying quite a lot of code (global/per URL statistics, grade of analysis, export to CSV/JSON, etc ...) but yes, it could be interesting to have specific sections for them.

• Regarding the value and messages of “X-Frame-Options”, checking the standards gives me the impression that the only valid values of this header are exactly 'DENY' or 'SAMEORIGIN' ('ALLOW-FROM' is deprecated): https://www.rfc-editor.org/rfc/rfc7034#section-2.1, https://html.spec.whatwg.org/multipage/document-lifecycle.html#the-x-frame-options-header and https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options#syntax. Hence the need to indicate that any other value is not correct, and also indicate the suggestion to use a more current option, such as 'frame-ancestors' from CSP.

Regards,

[rfc-st]

Hi, @cr4zyfish

Check out this commit: aeabd4b

'humble' checks, thanks to your suggestion, the values of headers defined via meta tags. For now two of them; I will improve this functionality.

I've added you at https://github.com/rfc-st/humble/?tab=readme-ov-file#acknowledgements.

Thanks & regards!.