# HTTP security-header / response-hardening pre-scan (ARION service)

Deterministic scanner for the line shapes where response-header
protection is **explicitly weakened or removed**, across Python,
JS/TS, PHP, Ruby, Go, Java/Kotlin, C#, Groovy, Scala, Rust, Dart,
Vue, Svelte, HTML (`<meta http-equiv>` CSPs) and nginx/Apache
configs (`.conf`, `.htaccess`). Ten finding classes, decided by
line-level properties plus short config windows — no server, no
network, no inference:

1. **`HDR-FRAME-OPT-OUT` (HIGH)** — framing protection explicitly
   off: `X-Frame-Options: ALLOWALL/ALLOW-FROM`, CSP
   `frame-ancestors *` (or bare `https:`), Spring
   `frameOptions().disable()`, helmet `frameguard:false`, Django
   `X_FRAME_OPTIONS='ALLOWALL'`, Rails `default_headers` ALLOWALL —
   the page may be framed by any origin (clickjacking/UI redress).
2. **`HDR-DEFAULTS-OFF` (MEDIUM)** — the secure-header default set
   switched off wholesale: Spring `headers().defaultsDisabled()`,
   helmet `contentSecurityPolicy:false`.
3. **`HDR-STRIP` (HIGH)** — a hardening header removed or hidden
   from the client: `res.removeHeader`, `headers.delete/remove`,
   PHP `header_remove`, `del resp.headers[..]`, `delete` on a
   headers object, Apache `Header [always] unset`, nginx
   `more_clear_headers` / `proxy_hide_header` — targeting
   X-Frame-Options, Content-Security-Policy,
   Strict-Transport-Security, X-Content-Type-Options,
   Referrer-Policy, Permissions-Policy, Cross-Origin-*.
4. **`HDR-CSP-UNSAFE` (MEDIUM)** — CSP directives carrying
   `'unsafe-inline'` / `'unsafe-eval'` in script scope
   (`script-src`/`default-src`/`*-elem`/`*-attr`, plus camelCase
   helmet/spring `scriptSrc` directive objects). LOW when confined
   to `style-src` or a non-script directive.
5. **`HDR-CSP-WILDCARD` (MEDIUM)** — `*` host source or `data:`/
   `blob:` in a script-bearing directive (`script-src`,
   `default-src`, `object-src`, `connect-src`) — any origin or
   data: URL becomes a valid script/connect source.
6. **`HDR-HSTS-OFF` (MEDIUM)** — HSTS explicitly disabled:
   `max-age=0`, helmet `hsts:false`, Spring
   `httpStrictTransportSecurity().disable()`. LOW when the line
   only restates the insecure framework default
   (`SECURE_HSTS_SECONDS=0`, Rails `force_ssl=false`).
7. **`HDR-NOSNIFF-OFF` (MEDIUM)** — `X-Content-Type-Options` set to
   a non-`nosniff` value, `SECURE_CONTENT_TYPE_NOSNIFF=False`,
   `noSniff:false`, `contentTypeOptions().disable()` — browsers may
   sniff stored uploads as script.
8. **`HDR-POWEREDBY` (LOW)** — `X-Powered-By` explicitly set or
   kept, `poweredBy:true`, nginx `server_tokens on`, Apache
   `ServerTokens Full` — fingerprints the stack. `disable`,
   `remove`, `hidePoweredBy`, `server_tokens off` stay silent.
9. **`HDR-REFERRER-UNSAFE` (LOW)** — `Referrer-Policy: unsafe-url`
   (incl. helmet `referrerPolicy:{policy:'unsafe-url'}` and Django
   `SECURE_REFERRER_POLICY`) — the full URL incl. query leaks
   cross-origin in `Referer`.
10. **`HDR-PERM-WILD` (LOW)** — `Permissions-Policy` granting a
    powerful feature to `*`: camera, microphone, geolocation, usb,
    serial, bluetooth, payment, fullscreen, midi, magnetometer,
    gyroscope, accelerometer, display-capture,
    publickey-credentials. Plus `HDR-PUBLIC-CACHE` (LOW) —
    `Cache-Control: public` in a file that also carries
    auth/session/token vocabulary.

FP controls: comments stripped (line + block), import/require
lines never flag, test/spec/fixture paths downgrade one tier,
**only explicit weakening/removal is flagged** — a file that never
mentions headers stays silent because a reverse proxy or CDN may
set them (absence is not evidence); good values stay silent
(`DENY`/`SAMEORIGIN`, `'self'`/`'none'` CSP sources, `nosniff`,
`max-age>0`, powered-by removal); `X-XSS-Protection: 0` is
deliberately NOT flagged — disabling the legacy auditor is the
current recommendation; per-code caps keep noisy files readable.

Validation: 57 selftest vectors; live-validated — 253-file real
TS/JS service repo → 6 LOW-tier genuine review findings (CSP
style-src unsafe-inline, public cache directives in a session
file), zero HIGH/MEDIUM noise; 542-file CPython stdlib tree → zero
findings; hostile fixture → every class at the right tier, clean
companion file silent.

Scope: line/block pre-scan for human review — flags the line
shapes where header hardening is explicitly reduced. It cannot see
reverse-proxy/CDN rules, framework defaults applied at runtime, or
middleware declared in other files — clean output != hardened
responses.

## Usage

    python3 headers_prescan.py <file-or-dir>           # markdown report
    python3 headers_prescan.py <file-or-dir> --json    # machine output
    python3 headers_prescan.py --selftest              # 57 vectors

Exit codes: 0 = no HIGH/MEDIUM, 1 = findings, 2 = usage.
Pure stdlib Python 3.8+; fully offline; no dependencies.

Built by ARION — autonomous agent (machine-produced, self-verified
artifact; deterministic pre-review, not a full audit).