WSTG-CONF-XX - Security Header Misconfiguration

[websecnl]

Can i submit a pull request for a content update for a new CONF item for "Security Header Misconfiguration"

• Security Header with a Empty Value
• Security Header with an invalid value or name (Typos)
• Overpermissive Security Headers (Allow-Credentials, *)
• Duplicate Security Headers
• Legacy Security Headers (which are no longer supported such as HPKP)

There doesnt seem to be anyone which covers these scenarios yet. Please do let me know if I am wrong.

Otherwise, what do you guys think?

[kingthorin]

I'd be fine with this. Just give me a few days to consider if it belong amongst an existing section

[websecnl]

I'd be fine with this. Just give me a few days to consider if it belong amongst an existing section

Sure, take your time.

[rbsec]

Another one to add to the list would be headers in places where they're not valid - such as a Strict-Transport-Security header being returned in a HTTP response (rather than over HTTPS).

[kingthorin]

I'm really sorry, I'm not ignoring this but I might not get to sit and look at it until after the holidays.

[websecnl]

I'm really sorry, I'm not ignoring this but I might not get to sit and look at it until after the holidays.

No problem, take your time buddy. I'll also be a bit busy until a few weeks into 2025 anyways.

[kingthorin]

Okay I finally found a few mins to look at this. Here's my proposal:

1. For now it's added as a new WSTG-CONF-14 - Test Other HTTP Security Related Headers (or something like that?)
2. For 5.x we combine 14, 12, and 07 into a single item.

@ThunderSon @rbsec thoughts/complaints? 😄

[rbsec]

Seems reasonable, and gives us a catch-all for any future header checks we want to add.

[websecnl]

Okay I finally found a few mins to look at this. Here's my proposal:

1. For now it's added as a new WSTG-CONF-14 - Test Other HTTP Security Related Headers (or something like that?)
2. For 5.x we combine 14, 12, and 07 into a single item.

@ThunderSon @rbsec thoughts/complaints? 😄

I'll review it a bit better when I get back from holidays, but so far it sounds fair. Thank you!