'humble' (HTTP Headers Analyzer)
https://github.com/rfc-st/humble | v.2025-05-23
[0. Info]
Date : 2025/05/23 - 21:19:13
URL : https://facebook.com
File : humble_https_facebook.com_20250523_211913_en.html
Note : The URL returns an error (HTTP code 400, 'Bad Request')
Ref : https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Status400
[1. Enabled HTTP Security Headers]
Cache-Control: private, no-cache, no-store, must-revalidate
Content-Security-Policy: default-src blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;script-src *.facebook.com *.fbcdn.net 127.0.0.1:* 'nonce-obH9laIV' blob: data: 'self' 'wasm-unsafe-eval';style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net wss://*.facebook.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ *.fbsbx.com *.fb.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net blob: android-webview-video-poster: *.fb.com *.oculuscdn.com https://paywithmybank.com/ https://*.paywithmybank.com/;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data:;child-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net accounts.meta.com https://paywithmybank.com/ https://*.paywithmybank.com/;manifest-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;object-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Content-Type: text/html; charset="utf-8"
Cross-Origin-Embedder-Policy-Report-Only: require-corp;report-to="coep_report"
Cross-Origin-Opener-Policy: same-origin-allow-popups;report-to="coop_report"
Origin-Agent-Cluster: ?1
Pragma: no-cache
Report-To: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown&brsid=7507722887575313942&cpp=C3&cv=1023141079&st=1748027952693"}]}
Reporting-Endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown&brsid=7507722887575313942&cpp=C3&cv=1023141079&st=1748027952693"
Strict-Transport-Security: max-age=15552000; preload
X-Content-Type-Options: nosniff
X-Frame-Options: DENY
X-Xss-Protection: 0
[2. Missing HTTP Security Headers]
Clear-Site-Data
Clears browsing data (cookies, storage, cache) associated with the requesting website.
Ref: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Clear-Site-Data
Cross-Origin-Embedder-Policy
Prevents documents and workers from loading non-same-origin requests unless allowed.
Ref: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Cross-Origin-Embedder-Policy
Cross-Origin-Resource-Policy
Protect servers against certain cross-origin or cross-site embedding of the returned source.
Ref: https://developer.mozilla.org/en-US/docs/Web/HTTP/Cross-Origin_Resource_Policy_(CORP)
(*) NEL
Enables web applications to declare a reporting policy to report errors.
Ref: https://scotthelme.co.uk/network-error-logging-deep-dive/
(*) Permissions-Policy
Previously called "Feature-Policy", allow and deny the use of browser features.
Ref: https://scotthelme.co.uk/goodbye-feature-policy-and-hello-permissions-policy/
Referrer-Policy
Controls how much referrer information should be included with requests.
Ref: https://scotthelme.co.uk/a-new-security-header-referrer-policy/
X-Permitted-Cross-Domain-Policies
Limit which data external resources (e.g. Adobe Flash/PDF documents), can access on the domain.
Ref: https://owasp.org/www-project-secure-headers/#div-headers
[3. Fingerprint HTTP Response Headers]
These headers can leak information about software, versions, hostnames or IP addresses:
X-FB-Debug (facebook.com Platform)
Value: 'SvuvlM7WsVej9fyDskhSLgR3tObbyuFT3LmjRO4LF1VeiDjNL+tWSXHYTb+NaBa+JxySDyQkaywGiDWcXe0pJQ=='
[4. Deprecated HTTP Response Headers/Protocols and Insecure Values]
The following headers/protocols are deprecated or their values may be considered unsafe:
Content-Security-Policy (Deprecated Directives)
Avoid deprecated or ignored directives: 'block-all-mixed-content', 'report-uri'
Ref: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy
Content-Security-Policy ('base-uri' Directive Missing)
This directive prevents base tag injection; try to set it to 'none' or 'self'.
Ref: https://csplite.com/csp95/
(*) Content-Security-Policy ('require-trusted-types-for' Directive Missing)
This directive prevents DOM XSS injection in scripts; try to set it to 'script'.
Ref: https://content-security-policy.com/require-trusted-types-for/
Content-Security-Policy (Too Permissive Sources)
Review the directives 'child-src', 'connect-src', 'default-src', 'font-src', 'frame-src', 'img-src', 'manifest-src', 'media-src', 'object-src', 'script-src', 'style-src', 'worker-src'.
And limit permissive sources: 'blob:', 'data:'
Ref: https://content-security-policy.com/
Content-Security-Policy (Insecure Schemes)
Review the directive 'connect-src'.
And do not allow insecure, unencrypted schemes: 'http:', 'ws:'
Ref: https://www.cloudflare.com/learning/ssl/why-is-http-not-secure/
Ref: https://http.dev/wss
Content-Security-Policy (Unsafe Values)
Review the directive 'style-src'.
The values 'unsafe-inline' or 'unsafe-eval' increase the risk of Cross-site scripting.
Ref: https://csper.io/blog/no-more-unsafe-inline
Ref: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/eval
Ref: https://content-security-policy.com/hash/
Ref: https://content-security-policy.com/nonce/
Content-Security-Policy (Unsafe Nonce)
Rewiew the nonce 'obH9laIV'.
All should be at least 128 bits long (32 hex characters / 24 base64 characters).
Ref: https://www.w3.org/TR/CSP3/#security-nonces
Pragma (Deprecated Header)
This header is deprecated.
Ref: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Pragma
Report-To (Deprecated Header)
This header is deprecated. Use instead "Reporting-Endpoints".
Ref: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Report-To
Strict-Transport-Security (Recommended Values)
Add 'includeSubDomains' and 'max-age' (with 31536000 -one year- as minimum).
Ref: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security
Ref: https://https.cio.gov/hsts/
Strict-Transport-Security (Required Values)
'preload' requires 'includeSubDomains' and 'max-age' (with 31536000 -one year- as minimum).
Ref: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security
Vary (Potentially Unsafe Header)
The values of this header may expose others, facilitating attacks if user input is accepted.
Ref: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Vary
Ref: https://www.yeswehack.com/fr/learn-bug-bounty/http-header-exploitation
X-XSS-Protection (Deprecated Header)
This header is deprecated in the three major web browsers.
Instead, use the "Content-Security-Policy" header restrictively.
Ref: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-XSS-Protection
[5. Empty HTTP Response Headers Values]
Empty HTTP headers (and are therefore considered disabled):
Nothing to report, all seems OK!
[6. Browser Compatibility for Enabled HTTP Security Headers]
https://caniuse.com/?search=Cache-Control
https://caniuse.com/?search=contentsecuritypolicy2
https://caniuse.com/?search=Content-Type
https://caniuse.com/?search=Cross-Origin-Opener-Policy
https://caniuse.com/?search=Origin-Agent-Cluster
https://caniuse.com/?search=Pragma
https://caniuse.com/?search=Report-To
https://caniuse.com/?search=Reporting-Endpoints
https://caniuse.com/?search=Strict-Transport-Security
https://caniuse.com/?search=Vary
https://caniuse.com/?search=X-Content-Type-Options
https://caniuse.com/?search=X-Frame-Options
https://caniuse.com/?search=X-XSS-Protection
[7. Analysis Results]
Done in 0.26 seconds! (changes with respect to the last analysis in parentheses)
Enabled headers: 13 (First Analysis)
Missing headers: 7 (First Analysis)
Fingerprint headers: 1 (First Analysis)
Deprecated/Insecure headers: 13 (First Analysis)
Empty headers: 0 (First Analysis)
Findings to review: 21 (First Analysis)
Analysis Grade: D (Review 'Deprecated/Insecure headers')
'(*)' meaning: Experimental HTTP response directive or header
'(*)' ref: https://mdn.io/Experimental_deprecated_obsolete