Lab 07 — Web Security Policy Analyzer (CORS / CSP / Clickjacking)

Chapter: 13 (The Rest of the Web Attack Surface).

Threat model

Three of the most-misconfigured, most-under-reported web controls live in response headers. The "attacker" here is a silent misconfiguration: a CORS policy that reflects the request Origin with credentials (any site reads your authenticated responses → account takeover), a CSP weakened to 'unsafe-inline' (XSS runs anyway), or a sensitive page with no frame-ancestors/X-Frame-Options (clickjackable). This engine parses those headers and flags each weakness with a severity, so a review or CI gate catches them deterministically.

What you build (lab.py)

  • parse_csp(csp) — {directive: [sources]}.
  • analyze_cors(r) — origin reflection (critical with credentials), null origin, wildcard, wildcard+credentials. Trusted origins are not flagged.
  • analyze_csp(r) — missing CSP, 'unsafe-inline'/'unsafe-eval'/wildcard in the script-governing directive, no script restriction, permissive object-src.
  • analyze_framing(r) — clickjacking exposure when neither frame-ancestors nor a valid X-Frame-Options is present.
  • analyze(r) — all findings, sorted severity-desc then id; is_safe(r) — nothing medium-or-above.

Attack cases the tests cover

  • CORS is not access control: reflecting an untrusted Origin with credentials = critical (read credentialed responses); without credentials = high; a trusted origin is clean.
  • null and wildcard origins; wildcard + credentials (a broken intent).
  • CSP is defense-in-depth: 'unsafe-inline' / wildcard script-src defeat it; default-src governs script when script-src is absent.
  • Clickjacking: flagged when unprotected; cleared by X-Frame-Options: DENY or frame-ancestors.
  • Deterministic severity-ordered output.

Run

pip install -r requirements.txt
LAB_MODULE=solution pytest -q
pytest -q

Hardening / extensions

  • Add CORS preflight correctness (Access-Control-Allow-Methods/Headers, Vary: Origin).
  • Parse Strict-Transport-Security, Referrer-Policy, Permissions-Policy, cookie attributes.
  • Evaluate CSP bypass gadgets (JSONP endpoints, 'strict-dynamic', allowlisted CDNs hosting UGC).
  • Wire it to a crawler so it analyzes live response headers (authorized targets only).

Interview / resume

"Built a header-policy analyzer that flags origin-reflecting/credentialed CORS, unsafe CSP, and missing clickjacking protection — encoding that CORS is not an access control and CSP is defense-in-depth, not an XSS fix."

Limitations: static header analysis only; doesn't fetch live sites; CSP bypass-gadget detection is out of scope.