meetinthemiddle-be / security-headers-best-practise Goto Github PK

in-resp = HTTP response contains the header
off-resp = HTTP response doesn't contain the header
in-spec = YAML spec contains the header
off-spec = YAML spec doesn't contain the header

CAT 1 : off-resp / in-spec

• if maxcount==0, this is good (don't need & don't see)
• if maxcount > 0 this is not good (need & don't see )

CAT 2 : in-resp / in-spec

• if # < mincount : not good (need & see too few )
• if # > maxcount : not good (need & see too many )
• if mincount <= # <= maxcount : this is good (need and see # in bounds)

CAT 3 : in-resp / off-spec

• Can't make a claim on that. Advise to add to spec.