Clickjacking)

Chapter: 13 (The Rest of the Web Attack Surface).

Threat model

Three of the most-misconfigured, most-under-reported web controls live in response headers. The "attacker" here is a silent misconfiguration: a CORS policy that reflects the request Origin with credentials (any site reads your authenticated responses → account takeover), a CSP weakened to 'unsafe-inline' (XSS runs anyway), or a sensitive page with no frame-ancestors/X-Frame-Options (clickjackable). This engine parses those headers and flags each weakness with a severity, so a review or CI gate catches them deterministically.

What you build (`lab.py`)

parse_csp(csp) — {directive: [sources]}.
analyze_cors(r) — origin reflection (critical with credentials), null origin, wildcard, wildcard+credentials. Trusted origins are not flagged.
analyze_csp(r) — missing CSP, 'unsafe-inline'/'unsafe-eval'/wildcard in the script-governing directive, no script restriction, permissive object-src.
analyze_framing(r) — clickjacking exposure when neither frame-ancestors nor a valid X-Frame-Options is present.
analyze(r) — all findings, sorted severity-desc then id; is_safe(r) — nothing medium-or-above.

Attack cases the tests cover

CORS is not access control: reflecting an untrusted Origin with credentials = critical (read credentialed responses); without credentials = high; a trusted origin is clean.
null and wildcard origins; wildcard + credentials (a broken intent).
CSP is defense-in-depth: 'unsafe-inline' / wildcard script-src defeat it; default-src governs script when script-src is absent.
Clickjacking: flagged when unprotected; cleared by X-Frame-Options: DENY or frame-ancestors.
Deterministic severity-ordered output.

Run

pip install -r requirements.txt
LAB_MODULE=solution pytest -q
pytest -q

Hardening / extensions

Add CORS preflight correctness (Access-Control-Allow-Methods/Headers, Vary: Origin).
Parse Strict-Transport-Security, Referrer-Policy, Permissions-Policy, cookie attributes.
Evaluate CSP bypass gadgets (JSONP endpoints, 'strict-dynamic', allowlisted CDNs hosting UGC).
Wire it to a crawler so it analyzes live response headers (authorized targets only).

Interview / resume

"Built a header-policy analyzer that flags origin-reflecting/credentialed CORS, unsafe CSP, and missing clickjacking protection — encoding that CORS is not an access control and CSP is defense-in-depth, not an XSS fix."

Limitations: static header analysis only; doesn't fetch live sites; CSP bypass-gadget detection is out of scope.

Security Engineer