Unit 3: Headers · Lesson 4 of 5 · 24 min
Project: a header baseline script
Write a small script that checks every page for the security headers you care about.
mission
- You are
- The analyst reviewing the shop.
- Situation
- Headers break quietly when routes are added. The team wants a check they can rerun after each release.
- Goal
- Write a script that prints a yes or dash for four headers on every page.
- Hand in
- baseline.sh and its output table.
What the script does
- for each pagea fixed list
- curl -sIfetch the head once
- grep -qiis the header there?
- tableyes or -
Write the script
Fetch each head once, then test it for each header. grep -q prints nothing and only sets the exit status.
cat > baseline.sh <<'EOF'
printf '%-10s %-5s %-5s %-5s %-5s\n' path csp xfo ref nosniff
for p in / /shop /login /help /admin /health; do
h=$(curl -sI http://127.0.0.1:8000$p)
printf '%-10s' $p
for n in content-security-policy x-frame-options referrer-policy x-content-type-options; do
if echo "$h" | grep -qi "^$n:"; then printf ' %-5s' yes; else printf ' %-5s' '-'; fi
done
echo
done
EOF
you should see No output. The script is now in baseline.sh.
cat- Prints the contents of one or more files. Built into Linux and macOS.
printf- Prints formatted text. Built into Linux and macOS.
curl- Sends web requests and prints the response. Built into Linux, macOS and Windows 10 and later.
grep- Prints the lines of text that match a pattern. Built into Linux and macOS.
echo- Prints its arguments. Built into Linux and macOS.
Run it
bash baseline.sh
path csp xfo ref nosniff
/ - - - yes
/shop yes yes yes yes
/login - - - -
/help yes - - yes
/admin - - - -
/health - - - -
you should see Only /shop and /help carry a policy, and three pages miss all four headers.
bash- Starts the bash shell, or runs a bash script. Built into Linux and macOS.
Count the gaps
bash baseline.sh | tail -n +2 | grep -o ' - ' | wc -l
17
you should see The number of missing headers across all pages: your first metric.
defender tip Commit a script like this next to the app and run it in CI. A release that drops a header then fails before it ships.
tail- Prints the last lines of a file, or follows it as it grows with -f. Built into Linux and macOS.
wc- Counts lines, words and bytes. Built into Linux and macOS.
Keep the result as evidence
bash baseline.sh > baseline.txt && wc -l < baseline.txt
7
you should see Seven lines: the header and six paths. Run it again after every fix and compare.
What a defender takes away
- 1Scripts turn a one-off review into a check you can repeat.
- 2Fetch each response once, then test it as many times as you need.
- 3Track the gap count over time; it should only go down.
Questions
0 of 3 solved
Answer each one from what you find on your lab machine.