Skip to content
This repository has been archived by the owner on Nov 4, 2024. It is now read-only.

Give points for not having any scripts #484

Open
wants to merge 2 commits into
base: main
Choose a base branch
from
Open

Give points for not having any scripts #484

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
65ffe6d
Give points for not having cookies
KamilaBorowska May 18, 2022
32826ef
Give points for not having scripts
Seirdy Sep 20, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions httpobs/docs/scoring.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,7 +39,7 @@ contribute-json-invalid-json | Contribute.json file cannot be parsed | -10
[Cookies](https://infosec.mozilla.org/guidelines/web_security#cookies) | Description | Modifier
--- | --- | :---:
cookies-secure-with-httponly-sessions-and-samesite | All cookies use the Secure flag, session cookies use the HttpOnly flag, and cross-origin restrictions are in place via the SameSite flag | 5
cookies-not-found | No cookies detected | 0
cookies-not-found | No cookies detected | 5
cookies-secure-with-httponly-sessions | All cookies use the `Secure` flag and all session cookies use the `HttpOnly` flag | 0
cookies-without-secure-flag-<br>but-protected-by-hsts | Cookies set without using the `Secure` flag, but transmission over HTTP prevented by HSTS | -5
cookies-session-without-secure-flag-<br>but-protected-by-hsts | Session cookie set without the `Secure` flag, but transmission over HTTP prevented by HSTS | -10
Expand Down Expand Up @@ -120,7 +120,7 @@ referrer-policy-header-invalid | `Referrer-Policy` header cannot be recognized |
sri-implemented-<br>and-all-scripts-loaded-securely | Subresource Integrity (SRI) is implemented and all scripts are loaded from a similar origin | 5
sri-implemented-<br>and-external-scripts-loaded-securely | Subresource Integrity (SRI) is implemented and all scripts are loaded securely | 5
sri-not-implemented-<br>but-all-scripts-loaded-from-secure-origin | Subresource Integrity (SRI) not implemented as all scripts are loaded from a similar origin | 0
sri-not-implemented-<br>but-no-scripts-loaded | Subresource Integrity (SRI) is not needed since site contains no script tags | 0
sri-not-implemented-<br>but-no-scripts-loaded | Subresource Integrity (SRI) is not needed since site contains no script tags | 5
sri-not-implemented-<br>response-not-html | Subresource Integrity (SRI) is only needed for html resources | 0
sri-not-implemented-<br>but-external-scripts-loaded-securely | Subresource Integrity (SRI) not implemented, but all external scripts are loaded over https | -5
request-did-not-return-status-code-200 | Site did not return a status code of 200 (deprecated) | -5
Expand Down
10 changes: 5 additions & 5 deletions httpobs/scanner/grader/grade.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -113,12 +113,12 @@
'modifier': 5,

},
'cookies-secure-with-httponly-sessions': {
'description': 'All cookies use the Secure flag and all session cookies use the HttpOnly flag',
'modifier': 0,
},
'cookies-not-found': {
'description': 'No cookies detected',
'modifier': 5,
},
'cookies-secure-with-httponly-sessions': {
'description': 'All cookies use the Secure flag and all session cookies use the HttpOnly flag',
'modifier': 0,
},
'cookies-without-secure-flag-but-protected-by-hsts': {
Expand Down Expand Up @@ -304,7 +304,7 @@
},
'sri-not-implemented-but-no-scripts-loaded': {
'description': 'Subresource Integrity (SRI) is not needed since site contains no script tags',
'modifier': 0,
'modifier': 5,
},
'sri-not-implemented-but-all-scripts-loaded-from-secure-origin': {
'description': 'Subresource Integrity (SRI) not implemented, but all scripts are loaded from a similar origin',
Expand Down