🛡️ HTTP 보안 헤더 점검: 내 블로그 응답에는 HSTS 하나만 붙어 있었다

$ curl -sI https://leekh8.github.io/
HTTP/1.1 200 OK
Server: GitHub.com
Content-Type: text/html; charset=utf-8
Access-Control-Allow-Origin: *
Strict-Transport-Security: max-age=31556952
Cache-Control: max-age=600
...

$ curl -sI https://github.com/
Strict-Transport-Security: max-age=31536000; includeSubdomains; preload
X-Frame-Options: deny
X-Content-Type-Options: nosniff
Referrer-Policy: origin-when-cross-origin, strict-origin-when-cross-origin
Content-Security-Policy: default-src 'none'; base-uri 'self'; ...
Set-Cookie: _gh_sess=...; path=/; secure; HttpOnly; SameSite=Lax

Content-Security-Policy: default-src 'self'; script-src 'self' https://www.googletagmanager.com; object-src 'none'; base-uri 'self'; frame-ancestors 'none'

$ curl -s https://leekh8.github.io/ -o index.html
$ grep -aoE '<script[^>]*>' index.html | sort | uniq -c
      2 <script>
      1 <script id="gatsby-script-loader">
      1 <script id="redux-ssr">
      1 <script data-react-helmet="true" type="application/ld+json">
      1 <script async="" src="https://www.googletagmanager.com/gtag/js?id=...">
      1 <script async="" src="https://pagead2.googlesyndication.com/pagead/js/adsbygoogle...">
      4 <script src="/...js" async>   # 번들 4개, 줄여서 표시
$ grep -aoE ' style="' index.html | wc -l
20

Content-Security-Policy-Report-Only: script-src 'self' 'strict-dynamic' 'sha256-...'; object-src 'none'; base-uri 'self'; report-to csp-endpoint

X-Frame-Options: DENY
Content-Security-Policy: frame-ancestors 'none'

X-Content-Type-Options: nosniff
Referrer-Policy: strict-origin-when-cross-origin
Permissions-Policy: camera=(), microphone=(), geolocation=()

Set-Cookie: __Host-session=abc123; Path=/; Secure; HttpOnly; SameSite=Lax

server {
    listen 443 ssl;
    # always가 없으면 4xx, 5xx 응답에는 헤더가 안 붙는다
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-Frame-Options "DENY" always;
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;

    location /api/ {
        # ❌ 여기서 add_header를 하나라도 쓰면 위 server 블록의 4개가 이 location에서 전부 빠진다
        add_header Cache-Control "no-store";
        proxy_pass http://backend;
    }
}

const helmet = require("helmet");

// ✅ 기본값으로 CSP, HSTS, nosniff, frameguard 등이 한 번에 붙는다
app.use(helmet());

{
  "headers": [
    {
      "source": "/(.*)",
      "headers": [
        { "key": "X-Content-Type-Options", "value": "nosniff" },
        { "key": "X-Frame-Options", "value": "DENY" },
        { "key": "Referrer-Policy", "value": "strict-origin-when-cross-origin" }
      ]
    }
  ]
}

"""응답 헤더 점검기. 표준 라이브러리만 쓴다."""
import re
import sys
import urllib.request


def hsts_ok(v):
    m = re.search(r"max-age=(\d+)", v or "")
    return bool(m) and int(m.group(1)) >= 31536000  # 1년 이상


def csp_ok(v):
    if not v:
        return False
    m = re.search(r"script-src([^;]*)", v)
    # script-src에 'unsafe-inline'이 있으면 XSS 방어가 거의 사라진다
    return not (m and "'unsafe-inline'" in m.group(1))


RULES = [
    ("Strict-Transport-Security", hsts_ok, "max-age 1년 이상"),
    ("Content-Security-Policy", csp_ok, "script-src에 'unsafe-inline' 없음"),
    ("X-Frame-Options", lambda v: (v or "").upper() in ("DENY", "SAMEORIGIN"), "DENY/SAMEORIGIN"),
    ("X-Content-Type-Options", lambda v: (v or "").lower() == "nosniff", "nosniff"),
    ("Referrer-Policy", bool, "있음"),
    ("Permissions-Policy", bool, "있음"),
]


def check(url):
    req = urllib.request.Request(url, headers={"User-Agent": "header-check"})
    with urllib.request.urlopen(req, timeout=10) as res:
        headers = res.headers

    csp = headers.get("Content-Security-Policy") or ""
    for name, ok, rule in RULES:
        value = headers.get(name)
        passed = ok(value)
        # CSP frame-ancestors가 X-Frame-Options를 대신한다
        if name == "X-Frame-Options" and "frame-ancestors" in csp:
            passed = True
        print(f"{'PASS' if passed else 'FAIL'}  {name:<26} {(value or '(없음)')[:40]:<42} 기준: {rule}")

    for cookie in headers.get_all("Set-Cookie") or []:
        attrs = cookie.lower()
        missing = [a for a in ("secure", "httponly", "samesite") if a not in attrs]
        name = cookie.split("=", 1)[0]
        print(f"{'WARN' if missing else 'PASS'}  cookie {name:<19} 빠진 속성: {', '.join(missing) or '없음'}")


if __name__ == "__main__":
    check(sys.argv[1])

$ python check_headers.py https://leekh8.github.io/
PASS  Strict-Transport-Security  max-age=31556952                           기준: max-age 1년 이상
FAIL  Content-Security-Policy    (없음)                                     기준: script-src에 'unsafe-inline' 없음
FAIL  X-Frame-Options            (없음)                                     기준: DENY/SAMEORIGIN
FAIL  X-Content-Type-Options     (없음)                                     기준: nosniff
FAIL  Referrer-Policy            (없음)                                     기준: 있음
FAIL  Permissions-Policy         (없음)                                     기준: 있음

$ python check_headers.py https://github.com/
PASS  Strict-Transport-Security  max-age=31536000; includeSubdomains; pre   기준: max-age 1년 이상
PASS  Content-Security-Policy    default-src 'none'; base-uri 'self'; chi   기준: script-src에 'unsafe-inline' 없음
PASS  X-Frame-Options            deny                                       기준: DENY/SAMEORIGIN
PASS  X-Content-Type-Options     nosniff                                    기준: nosniff
PASS  Referrer-Policy            origin-when-cross-origin, strict-origin-   기준: 있음
FAIL  Permissions-Policy         (없음)                                     기준: 있음
PASS  cookie _gh_sess            빠진 속성: 없음
WARN  cookie _octo               빠진 속성: httponly
PASS  cookie logged_in           빠진 속성: 없음