WSTG-CONF-XX - Security Header Misconfiguration

[websecnl]

Can i submit a pull request for a content update for a new CONF item for "Security Header Misconfiguration"

• Security Header with a Empty Value
• Security Header with an invalid value or name (Typos)
• Overpermissive Security Headers (Allow-Credentials, *)
• Duplicate Security Headers
• Legacy Security Headers (which are no longer supported such as HPKP)

There doesnt seem to be anyone which covers these scenarios yet. Please do let me know if I am wrong.

Otherwise, what do you guys think?

[kingthorin]

I'd be fine with this. Just give me a few days to consider if it belong amongst an existing section

[websecnl]

I'd be fine with this. Just give me a few days to consider if it belong amongst an existing section

Sure, take your time.

[rbsec]

Another one to add to the list would be headers in places where they're not valid - such as a Strict-Transport-Security header being returned in a HTTP response (rather than over HTTPS).

[kingthorin]

I'm really sorry, I'm not ignoring this but I might not get to sit and look at it until after the holidays.

[websecnl]

I'm really sorry, I'm not ignoring this but I might not get to sit and look at it until after the holidays.

No problem, take your time buddy. I'll also be a bit busy until a few weeks into 2025 anyways.

[kingthorin]

Okay I finally found a few mins to look at this. Here's my proposal:

1. For now it's added as a new WSTG-CONF-14 - Test Other HTTP Security Related Headers (or something like that?)
2. For 5.x we combine 14, 12, and 07 into a single item.

@ThunderSon @rbsec thoughts/complaints? 😄

[rbsec]

Seems reasonable, and gives us a catch-all for any future header checks we want to add.

[websecnl]

Okay I finally found a few mins to look at this. Here's my proposal:

1. For now it's added as a new WSTG-CONF-14 - Test Other HTTP Security Related Headers (or something like that?)
2. For 5.x we combine 14, 12, and 07 into a single item.

@ThunderSon @rbsec thoughts/complaints? 😄

I'll review it a bit better when I get back from holidays, but so far it sounds fair. Thank you!

[websecnl]

@kingthorin Could you please confirm if under "WSTG-CONF-14" the following apply:

• Security Header with a Empty Value
• Security Header with an invalid value or name (Typos)
• Overpermissive Security Headers (Allow-Credentials, *)
• Duplicate Security Headers
• Legacy Security Headers (which are no longer supported such as HPKP)

If so, wouldn't a better name be "WSTG-CONF-14 - Other HTTP Security Header Misconfigurations"
@ThunderSon @rbsec What do you guys think?

Any ETA on the release of this item?

[kingthorin]

Sure I'd be good with that naming.

Any ETA on the release of this item?

There isn't an ETA. Once someone does the work, it'll be reviewed, and ultimately merged and hit the live release. There is not yet a schedule for the release of v4.3.

[websecnl]

@kingthorin You okay if i do the work, i'll just make the pull request and then you guys can review it?

[kingthorin]

Absolutely 💯

[rbsec]

Sounds good to me.