65 lines
2.2 KiB
PHP
65 lines
2.2 KiB
PHP
<?php
|
|
// test-headers.php
|
|
function testSecurityHeaders($url) {
|
|
// Initialize cURL
|
|
$ch = curl_init($url);
|
|
|
|
// Set cURL options
|
|
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
|
|
curl_setopt($ch, CURLOPT_HEADER, true);
|
|
curl_setopt($ch, CURLOPT_NOBODY, true);
|
|
|
|
// Execute request
|
|
$response = curl_exec($ch);
|
|
|
|
// Get headers
|
|
$headers = [];
|
|
$headerLines = explode("\n", $response);
|
|
foreach ($headerLines as $line) {
|
|
if (strpos($line, ':') !== false) {
|
|
list($key, $value) = explode(':', $line, 2);
|
|
$headers[trim($key)] = trim($value);
|
|
}
|
|
}
|
|
|
|
// Define expected security headers
|
|
$expectedHeaders = [
|
|
'X-Content-Type-Options' => 'nosniff',
|
|
'X-Frame-Options' => 'DENY',
|
|
'X-XSS-Protection' => '1; mode=block',
|
|
'Content-Security-Policy' => 'default-src \'none\'',
|
|
'Access-Control-Allow-Origin' => null, // Will check if exists
|
|
'Access-Control-Allow-Methods' => null, // Will check if exists
|
|
'Access-Control-Allow-Headers' => null, // Will check if exists
|
|
'Strict-Transport-Security' => null // Will check if exists
|
|
];
|
|
|
|
// Check each expected header
|
|
echo "Security Headers Test Results:\n";
|
|
echo "==============================\n\n";
|
|
|
|
foreach ($expectedHeaders as $header => $expectedValue) {
|
|
if (isset($headers[$header])) {
|
|
if ($expectedValue === null) {
|
|
echo "✅ {$header} is present: {$headers[$header]}\n";
|
|
} elseif ($headers[$header] === $expectedValue) {
|
|
echo "✅ {$header} has correct value: {$headers[$header]}\n";
|
|
} else {
|
|
echo "❌ {$header} has incorrect value. Expected: {$expectedValue}, Got: {$headers[$header]}\n";
|
|
}
|
|
} else {
|
|
echo "❌ {$header} is missing\n";
|
|
}
|
|
}
|
|
|
|
// Check for HTTPS
|
|
$isHttps = strpos($url, 'https://') === 0;
|
|
echo $isHttps ?
|
|
"\n✅ HTTPS is enabled\n" :
|
|
"\n❌ HTTPS is not enabled - Security headers may not be effective!\n";
|
|
|
|
curl_close($ch);
|
|
}
|
|
|
|
// Usage
|
|
testSecurityHeaders('https://dev.veliti.nl/api.php'); |