HTTP header analysis for https://gitlab.com/onebusinessnews/weeb

HTTP Headers Analyzer

6 / 10

https://gitlab.com/onebusinessnews/weeb

WordPress → CloudFlare → Browser
3 missing headers, 3 warnings, 1 notices

The site is using a CDN, but the HTML page is not cached.

Value

Explanation

wed, 15 jan 2025 10:32:07 gmt

The date and time at which the request was made. A browser uses it for age calculations rather than using its own internal date and time; e.g. when comparing against Max-Age or Expires.

text/html; charset=utf-8

The type of the message body, specified as a MIME type.

40103

The size of the message body, in bytes.

90253332ae142d05-iad

The cf-ray header provides a unique identifier for each request through Cloudflare. It's useful for troubleshooting and tracking requests in Cloudflare logs.

miss

The page was not served from Cloudflare's cache.

bytes

Used by the server to advertise its support of partial HTTP requests. The browser can ask for a range or subset of the response body. It's a feature that allows a browser to resume an interrupted download. bytes is the only range unit currently supported. none means that the server does not support range requests.

max-age=0, private, must-revalidate

private means the response can only be stored by the browser's cache, but not by CDNs, proxies, or any other shared caches.
max-age=0 with must-revalidate means caching is disabled and all requests must be validated with the origin server.

w/"9389270396c47a2891a40772acb68b24"

A unique identifier that changes every time a page at a given URL changes. It acts as a fingerprint. A cache can compare Etag values to see if the page has changed and became stale. For example, a browsers will send the ETag value of a cached page in an If-None-Match header. The web server compares the ETag value sent by the browser with the ETag value of the current version of the page. If both values are the same, the web server sends back a 304 Not Modified status and no body. This particular Etag value starts with w/ which means that it is a weak identifier; while unlikely, multiple pages might have the same identifier. Weak identifiers are used because strong identifiers can be difficult and costly to generate.

max-age=31536000

The Strict-Transport-Security header (HSTS) instructs browsers to only use HTTPS for future connections to this domain, enhancing security by preventing downgrade attacks and cookie hijacking.
max-age specifies the time, in seconds, that the browser should remember to use HTTPS only for this domain.

The Vary header specifies a list of headers that must be considered when caching responses. For a cached response to be used, these headers must match between the cached response and the new request. This ensures that the appropriate version of a resource is served based on factors like language, encoding, or device type.

base-uri 'self'; child-src https://www.google.com/recaptcha/ https://www.recaptcha.net/ https://www.googletagmanager.com/ns.html https://*.zuora.com/apps/publichostedpagelite.do https://gitlab.com/admin/ https://gitlab.com/assets/ https://gitlab.com/-/speedscope/index.html https://gitlab.com/-/sandbox/ 'self' https://gitlab.com/assets/ blob: data:; connect-src 'self' https://gitlab.com wss://gitlab.com https://sentry.gitlab.net https://new-sentry.gitlab.net https://customers.gitlab.com https://snowplow.trx.gitlab.net https://sourcegraph.com https://collector.prd-278964.gl-product-analytics.com snowplowprd.trx.gitlab.net https://sourcegraph.com/.api/; default-src 'self'; font-src 'self'; form-action 'self' https: http:; frame-ancestors 'self'; frame-src https://www.google.com/recaptcha/ https://www.recaptcha.net/ https://www.googletagmanager.com/ns.html https://*.zuora.com/apps/publichostedpagelite.do https://gitlab.com/admin/ https://gitlab.com/assets/ https://gitlab.com/-/speedscope/index.html https://gitlab.com/-/sandbox/; img-src 'self' data: blob: http: https:; manifest-src 'self'; media-src 'self' data: blob: http: https:; object-src 'none'; report-uri https://new-sentry.gitlab.net/api/4/security/?sentry_key=f5573e26de8f4293b285e556c35dfd6e&sentry_environment=gprd; script-src 'strict-dynamic' 'self' 'unsafe-inline' 'unsafe-eval' https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.recaptcha.net/ https://apis.google.com https://*.zuora.com/apps/publichostedpagelite.do 'nonce-mcbxf+d4ducj0rnql+wnxq=='; style-src 'self' 'unsafe-inline'; worker-src 'self' https://gitlab.com/assets/ blob: data:

The Content Security Policy (CSP) header helps prevent cross-site scripting (XSS), clickjacking, and other code injection attacks by specifying which dynamic resources are allowed to load.
default-src sets the default policy for fetching resources like JavaScript, images, CSS, fonts, AJAX requests, frames, HTML5 media.
script-src specifies valid sources for JavaScript. This includes not only URLs loaded directly into <script> elements, but also things like inline script event handlers (onclick) and XSLT stylesheets which can trigger script execution.
base-uri defines what URLs can be used in the <base> URL.
object-src defines what <object>, <embed> and <applet> elements are allowed to be loaded and executed.
style-src defines what CSS stylesheets are allowed to be loaded.
media-src defines what <audio>, <video> and <track> elements are allowed to be loaded.
img-src defines what images and favicons can be loaded.
worker-src defines what workers scripts (e.g. Worker, ServiceWorker or SharedWorker) can be loaded and executed.
font-src defines what fonts can be loaded using CSS's font-face.
frame-src defines what <frame> and <iframe> elements can be loaded.
frame-ancestors defines what parents may embed a page using <frame>, <iframe>, <object>, <embed> or <applet>.
child-src defines what <frame>, <iframe> or workers can be loaded.
manifest-src defines what manifest files can be loaded.
form-action defines what URLs can be used for form submissions.
report-uri defines the URL that violations will be reported to. While report-uri is officially deprecated in favor of report-to, limited browser support for the latter means report-uri remains a viable option for now.
Notice Consider adding the upgrade-insecure-requests directive to automatically upgrade HTTP requests to HTTPS, helping to prevent mixed content issues.

haproxy-main-22-lb-gprd

web-gke-us-east1-c

interest-cohort=()

Instructs a browser to selectively allow or deny certain browser APIs and features. It helps improve security.

strict-origin-when-cross-origin

When a visitor navigates from one page to another page, browsers often pass along referrer information. The Referrer-Policy header controls how much referrer information a browser can share. This is important because private information can be embedded in the path or query string.
strict-origin-when-cross-origin means that the protocol, host, port, path and query string are shared for same-site requests. For cross-site requests, protocol, host, and port are shared, but only when the protocol security level remains the same (HTTP → HTTP, HTTPS → HTTPS). For cross-site requests where the protocol becomes less secure (HTTPS → HTTP), nothing is shared.

nosniff

The X-Content-Type-Options header, when set to nosniff, prevents MIME type sniffing. This enhances security by ensuring browsers respect the declared Content-Type of the response, mitigating MIME confusion attacks.
The value nosniff is correctly set, providing protection against MIME type sniffing attacks.

noopen

Alters the download dialog by removing the "Open with" option. Only supported by Internet Explorer.

sameorigin

X-Frame-Options prevents this URL from being embedded in an iframe. This protects against clickjacking attacks.
sameorigin means that this page can be displayed in a iframe, but only on the currrent origin. It can't be displayed on another domain. Consider setting this to deny for added security.

{"correlation_id":"01jhmraeyaxe353hgb4hvadgq5","version":"1"}

none

Instructs clients like Flash and Acrobat Reader what cross-domain policy they have to use. none is the most secure setting. Data can't be shared across domains.

01jhmraeyaxe353hgb4hvadgq5

A unique identifier for the HTTP request. This can be useful for tracking a request through complex systems or for debugging purposes.

0.250972

Indicates the time taken to generate the response on the server, typically in seconds. This can be useful for performance monitoring and debugging.

ie=edge

Instructs Internet Explorer what compatibility mode to use to render this page. For example, ie=9 specifies that the page should be rendered as if the user was using Internet Explorer 9, even if they use Internet Explorer 11 or later. It's basically a hack for working around compatibility issues between different versions of Internet Explorer.

1; mode=block

This header enables the browser's built-in XSS protection. However, it's considered legacy and modern browsers may ignore it.
1 enables the browser's cross-site scripting (XSS) filtering.
mode=block instructs the browser to block the response if a XSS attack is detected, instead of sanitizing the page.

{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=yxjqq55qnxzlxofzymojifw3x19pnk17erdf0dytg45xmocuc99tc1la85nhul28a3hghy0h1sihkfgiorpekkyfwbx8dpzbq2ibdsx%2fkrteuvkgevxyt1p9ufc%3d"}],"group":"cf-nel","max_age":604800}

This header is part of the Reporting API specification. They are used to configure the reporting of network errors and other issues to a specified endpoint.
The Report-To header specifies where reports should be sent.
group defines the reporting group. Groups allow reports to be grouped logically; e.g. there could be a group for network errors and a second group for browser feature deprecation reports.
max_age defines the number of seconds the browser should remember these settings. Prevents the browser from having to parse the JSON on each request.
endpoints defines one or more URLs where the reports need to be send to. Multiple URLs can be specified for failover and load-balancing. Endpoints can be assigned a weight to distribute load, with each endpoint receiving a specified fraction of the reporting traffic. Endpoints can also be assigned a priority to set up fallback collectors.

{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}

This header is part of the Reporting API specification. They are used to configure the reporting of network errors and other issues to a specified endpoint.
The NEL (Network Error Logging) header configures the reporting of network errors.
report_to defines the reporting group that reports for this NEL policy will be sent to. The reporting group details are specified in the Report-To header.
max_age defines the number of seconds the browser should remember these settings. Prevents the browser from having to parse the JSON on each request.
success_fraction defines the sampling rate that should be applied to reports about successful network requests. Its value must be a number between 0.0 and 1.0: 0 means no successful requests should be reported, and 1 means that every successful request should be reported.

cloudflare

missing Add a Cross-Origin-Embedder-Policy to specify how this page can be loaded by cross-origin resources.

missing Add a Cross-Origin-Opener-Policy header to opt-in into better browser isolation.

missing Add a Cross-Origin-Resource-Policy header to specify who can load this page.

Questions or feedback? Email dries@buytaert.net.