mondoo-http-security.mql.yaml

# Copyright (c) Mondoo, Inc.
# SPDX-License-Identifier: BUSL-1.1

policies:
  - uid: mondoo-http-security
    name: Mondoo HTTP Security
    version: 1.1.1
    license: BUSL-1.1
    tags:
      mondoo.com/category: security
      mondoo.com/platform: host
    authors:
      - name: Mondoo, Inc
        email: hello@mondoo.com
    docs:
      desc: |
        The Mondoo HTTP Security policy includes checks for ensuring the security of HTTP headers.

        ## Remote scan

        Remote scans use cnspec providers to retrieve on-demand scan results without having to install any agents.

        For a complete list of providers run:

        ```bash
        cnspec scan --help
        ```

        ### Scan a host

        ```bash
        cnspec scan host <fqdn>
        ```

        ## Join the community!

        Our goal is to build policies that are simple to deploy, accurate, and actionable.

        If you have any suggestions for how to improve this policy, or if you need support, [join the community](https://github.com/orgs/mondoohq/discussions) in GitHub Discussions.
    groups:
      - title: Headers for HTTP/HTTPS communication
        filters: asset.platform == 'host'
        checks:
          - uid: mondoo-http-security-x-content-type-options-nosniff
          - uid: mondoo-http-security-content-security-policy
          - uid: mondoo-http-security-obfuscate-server
          - uid: mondoo-http-security-no-x-powered-by
          - uid: mondoo-http-security-no-x-aspnet-version
          - uid: mondoo-http-security-no-x-aspnetmvc-version
          - uid: mondoo-http-security-no-public-key-pins
      - title: Headers for HTTPS communication
        filters: |
          asset.platform == 'host'
          tls.certificates != empty
        checks:
          - uid: mondoo-http-security-strict-transport-security
    scoring_system: highest impact
queries:
  - uid: mondoo-http-security-x-content-type-options-nosniff
    title: Set X-Content-Type-Options HTTP header to 'nosniff'
    mql: http.get.header.xContentTypeOptions == "nosniff"
    docs:
      desc: |
        Avoid MIME Type sniffing by setting the 'X-Content-Type-Options' HTTP header to 'nosniff'
    refs:
      - url: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Content-Type-Options
        title: MDN Web Docs X-Content-Type-Options
      - url: https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html#x-xss-protection
        title: OWASP HTTP Security Response Headers Cheat Sheet
  - uid: mondoo-http-security-content-security-policy
    title: Set Content Security Policy (CSP) HTTP header
    mql: http.get.header.params.keys.any('Content-Security-Policy')
    docs:
      desc: |
        Use the Content Security Policy (CSP) HTTP header to mitigate against Cross-Site Scripting (XSS) and data injection attacks.
    refs:
      - url: https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP
        title: MDN Web Docs Content Security Policy (CSP)
  - uid: mondoo-http-security-strict-transport-security
    title: Set Strict-Transport-Security (HSTS) HTTP header
    mql: http.get.header.params.keys.any('Strict-Transport-Security')
    docs:
      desc: |
        Use the Strict-Transport-Security (HSTS) to eliminate the need for a HTTP to HTTPS redirect and protect against man in the middle attacks.
    refs:
      - url: https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP
        title: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security
  - uid: mondoo-http-security-obfuscate-server
    title: Remove or obfuscate the Server header
    mql: http.get.header.params.keys.none("Server") || http.get.header.params["Server"].map(downcase).none(_ == /nginx|microsoft|apache|lsws|openresty/)
    docs:
      desc: |
        The X-Powered-By header exposes information about the server software. Remove it to reduce the attack surface.
    refs:
      - url: https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html#server
        title: OWASP HTTP Security Response Headers Cheat Sheet
  - uid: mondoo-http-security-no-x-powered-by
    title: Remove all X-Powered-By headers
    mql: http.get.header.params.keys.none("X-Powered-By")
    docs:
      desc: |
        The X-Powered-By header exposes information about the server software. Remove it to reduce the attack surface.
    refs:
      - url: https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html#x-powered-by
        title: OWASP HTTP Security Response Headers Cheat Sheet
  - uid: mondoo-http-security-no-x-aspnet-version
    title: Remove all X-AspNet-Version headers
    mql: http.get.header.params.keys.none("X-AspNet-Version")
    docs:
      desc: |
        The X-AspNet-Version header exposes information about the server software. Remove it to reduce the attack surface.
    refs:
      - url: https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html#x-aspnet-version
        title: OWASP HTTP Security Response Headers Cheat Sheet
  - uid: mondoo-http-security-no-x-aspnetmvc-version
    title: Remove all X-AspNetMvc-Version headers
    mql: http.get.header.params.keys.none("X-AspNetMvc-Version")
    docs:
      desc: |
        The X-AspNetMvc-Version header exposes information about the server software. Remove it to reduce the attack surface.
    refs:
      - url: https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html#x-aspnetmvc-version
        title: OWASP HTTP Security Response Headers Cheat Sheet
  - uid: mondoo-http-security-no-public-key-pins
    title: The header Public-Key-Pins is deprecated and should not be used
    mql: http.get.header.params.keys.none("Public-Key-Pins")
    docs:
      desc: |
        The Public-Key-Pins header is deprecated and should not be used anymore.
    refs:
      - url: https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html#public-key-pins-hpkp
        title: OWASP HTTP Security Response Headers Cheat Sheet