Unit 3: Headers · Lesson 4 of 5 · 24 min

Project: a header baseline script

Write a small script that checks every page for the security headers you care about.

mission

You are
The analyst reviewing the shop.
Situation
Headers break quietly when routes are added. The team wants a check they can rerun after each release.
Goal
Write a script that prints a yes or dash for four headers on every page.
Hand in
baseline.sh and its output table.

What the script does

  1. for each pagea fixed list
  2. curl -sIfetch the head once
  3. grep -qiis the header there?
  4. tableyes or -
01

Write the script

Fetch each head once, then test it for each header. grep -q prints nothing and only sets the exit status.

learner@web-lab
cat > baseline.sh <<'EOF'
printf '%-10s %-5s %-5s %-5s %-5s\n' path csp xfo ref nosniff
for p in / /shop /login /help /admin /health; do
  h=$(curl -sI http://127.0.0.1:8000$p)
  printf '%-10s' $p
  for n in content-security-policy x-frame-options referrer-policy x-content-type-options; do
    if echo "$h" | grep -qi "^$n:"; then printf ' %-5s' yes; else printf ' %-5s' '-'; fi
  done
  echo
done
EOF

you should see No output. The script is now in baseline.sh.

02

Run it

learner@web-lab
bash baseline.sh
path       csp   xfo   ref   nosniff
/          -     -     -     yes  
/shop      yes   yes   yes   yes  
/login     -     -     -     -    
/help      yes   -     -     yes  
/admin     -     -     -     -    
/health    -     -     -     -

you should see Only /shop and /help carry a policy, and three pages miss all four headers.

03

Count the gaps

learner@web-lab
bash baseline.sh | tail -n +2 | grep -o ' - ' | wc -l
17

you should see The number of missing headers across all pages: your first metric.

defender tip Commit a script like this next to the app and run it in CI. A release that drops a header then fails before it ships.

04

Keep the result as evidence

learner@web-lab
bash baseline.sh > baseline.txt && wc -l < baseline.txt
7

you should see Seven lines: the header and six paths. Run it again after every fix and compare.

What a defender takes away

  1. 1Scripts turn a one-off review into a check you can repeat.
  2. 2Fetch each response once, then test it as many times as you need.
  3. 3Track the gap count over time; it should only go down.

Questions

0 of 3 solved

Answer each one from what you find on your lab machine.