4 ms·
Analyzing the Top 10,000 Websites' HTTP Headers
- ck2 15y agoCorrect me if I am wrong but any of those extra headers except "Strict-Transport-Security" actually REDUCE security. By default the browser will be in it's more secure state and those headers actually drop the security to allow cross communication with (specific) other websites.
- kijin 15y agoYou may be right about X-XSS-Protection (with the IE8 bug) and Access-Control-Allow-Origin (when set to "*"), but I wouldn't say that X-Frame-Options reduces security. It has two possible values, SAMEORIGIN and DENY, both of which help prevent clickjacking attacks without allowing any additional cross-communication.
- CWIZO 15y agoIt's down for me. Cached version: http://webcache.googleusercontent.com/search?q=cache:BVs3oHYHqDcJ:www.shodanhq.com/research/infodisc/report+http://www.shodanhq.com/research/infodisc/report&cd=1&hl=en&ct=clnk http://webcache.googleusercontent.com/search?q=cache:BVs3oHY...
- marcinw 15y agoWow, 61% of websites that responded with an Access-Control-Allow-Origin header had a value set to "*". This allows for the website to be access in a cross-domain manner (think XSS, global wild cards in crossdomain.xml, etc). I'm worried to think how site operators will adopt CSP (Content Security Policy) once it starts to gain traction.
- wvl 15y agoThis article is extremely poorly written. If you look at the top graph, 0.05% of the 10,000 websites make use of the header. Of those, 61% had a value set to " * ". 0.05% of 10,000 is 5, so 3 websites had that header set to " * ". I guess 3 is just not quite as scary as saying 61%.
- GoGlobal 15y agoPage is down...
- sp332 15y agoHere's a cache http://www.shodanhq.com.nyud.net/research/infodisc/report http://www.shodanhq.com.nyud.net/research/infodisc/report
- Sukotto 15y agoWhat does "grabbing the banners of those websites" mean? What would I type into wget or curl to download the "banner" of a site?
- fmavituna 15y agoIt's referring to HTTP Headers in the response. I think -I switch in curl will give you only response headers.
- marcinw 15y ago-I is an HTTP HEAD request (which may return a different response code than a traditional GET). To print the headers in any kind of request, use lowercase -i.