Chapter 25 — Laboratory I
Lesson map
Lesson 25 published. Map, example, EX073.
flowchart TD
N0["Learning outcomes"]
N1["25.1 Security headers"]
N2["Lab — Lab — header check"]
N3["25.2 Lab result"]
N4["25.3 Adding headers"]
N5["25.4 Removing information"]
N6["25.5 Automated tests"]
N7["25.6 Lab practice"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX073"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["25.1 Security headers"]
N2["Lab — Lab — header check"]
N3["25.2 Lab result"]
N4["25.3 Adding headers"]
N5["25.4 Removing information"]
N6["25.5 Automated tests"]
N7["25.6 Lab practice"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX073"]
[Learning outcomes]
|
v
[25.1 Security headers]
|
v
[Lab — Lab — header check]
|
v
[25.2 Lab result]
|
v
[25.3 Adding headers]
|
v
[25.4 Removing information]
|
v
[25.5 Automated tests]
|
v
[25.6 Lab practice]
|
v
[Worked example] --> [Exercise EX073]
Learning outcomes
You will (1) check an application's HTTP security headers; (2) interpret missing headers; (3) add headers safely; (4) test them automatically.
25.1 Security headers
Browsers apply extra protections when servers send certain headers: Content-Security-Policy limits which scripts and resources can load; Strict-Transport-Security makes the browser use HTTPS only; X-Content-Type-Options stops the browser guessing content types; Referrer-Policy limits information in links to other sites. OWASP's testing guide (WSTG v4.2) includes checks for such configuration.
Headers are a cheap layer of defence because one server setting protects every page. Lena checks the headers already listed in her earlier notes from the networks chapter and adds the ones the lab is about to test, with a short note on what each prevents for CampusEats.
Lab — Lab — header check
"""Check a synthetic HTTP response for recommended security headers."""
resp = {"Content-Type": "text/html; charset=utf-8", "Strict-Transport-Security": "max-age=31536000",
"X-Content-Type-Options": "nosniff", "Server": "campuseats/1.0"}
wanted = ["Content-Security-Policy", "Strict-Transport-Security", "X-Content-Type-Options", "Referrer-Policy"]
for h in wanted:
print(f"{h:27} {'present' if h in resp else 'MISSING'}")
Run with python3 lab_headers.py. Verified output:
Content-Security-Policy MISSING
Strict-Transport-Security present
X-Content-Type-Options present
Referrer-Policy MISSING
25.2 Lab result
Strict-Transport-Security and X-Content-Type-Options are present. Content-Security-Policy and Referrer-Policy are missing. The response also reveals a "Server" header naming the software version, which gives unnecessary information.
Lena records the result in the private tracker, with each missing header as a separate item and an owner. None is an emergency, since the encoding checks already protect review pages, but each missing header removes a layer that would help if another control failed. The Server header is a small information leak rather than a flaw, and it is the easiest of the three to fix.
25.3 Adding headers
Referrer-Policy is simple to add. Content-Security-Policy needs care: a strict policy can break pages that load scripts from other places. Lena starts with a report-only policy that logs violations without blocking, reviews the reports for two weeks, then enforces.
The reports show two legitimate scripts that the first draft of the policy would have blocked, the payment provider's form and a font loader, and the policy is adjusted for them before enforcement. Referrer-Policy is enforced at once, since it cannot break pages. Lena records both changes in a decision record.
25.4 Removing information
The Server header is reduced to a generic value.
Hiding the version does not fix any flaw, but it stops the response from advertising which software and version the server runs, so anyone looking for known weaknesses has to work harder. The change is made in the hosting platform's configuration and confirmed by repeating the lab request. Lena notes in the tracker that this is a minor hardening step and that keeping the software updated matters far more than concealing it.
25.5 Automated tests
A CI test requests key pages in the test environment and checks headers, so a later change cannot silently remove them.
The test lists the expected headers and their values in one file, so changing a policy is a reviewed edit to that file. It checks the home page, the order page and the staff screens, since these use different templates and a header could be set on one but not the others. A failed check stops deployment, like any other test.
25.6 Lab practice
All checks run against the test environment, never against systems the society does not own.
Lena's permission covers the test environment only, so she never points the lab tools at the live service, the payment provider or the university's other sites. Where a check needs to compare test and production, such as confirming the same headers are sent, she asks the administrators to export the production configuration instead of probing it. This keeps the lab within its agreed scope. Her notes record the scope.
Recording results
Lena records each header check result with the date and environment in the lab notebook, so later changes can be compared against a known starting point. The notebook also lists which pages were checked and why.
Sharing
Results are shared with members at the next meeting.
Worked example
During the report-only period, the reports show one blocked resource: a font loaded from an external site. The font is copied to CampusEats' own domain, and the enforced policy goes live without breaking any page.
Synthetic case. Headers and reports are synthetic.
Errors and limits
Headers help browsers protect users but do not fix flaws in the application itself.
Exercises
- EX073 — Lab missing. Which headers were missing? Rubric: 3 = Content-Security-Policy and Referrer-Policy; 2 = one; 1 = vague; 0 = none.
- EX074 — CSP rollout. How was CSP introduced safely? Rubric: 3 = report-only two weeks; then enforce; 2 = partial; 1 = vague; 0 = none.
- EX075 — Server header. Why reduce the Server header? Rubric: 3 = reveals software version unnecessarily; 2 = partial; 1 = vague; 0 = none.
Synthesis
Check headers, roll out policies carefully and keep them tested.
Continue studying — chapter 25 of 40
← Chapter 24 (draft) · Course chapter index · Chapter 26 (draft) →