Module headers 

HTTP security-header and cookie audit.

Seer already inspects a domain’s transport layer (crate::ssl, crate::caa), its DNS/email layer (crate::posture, crate::dns), and its registration layer (crate::whois, crate::rdap). This module covers the remaining one: what the origin actually sends back over HTTP.

A single SSRF-guarded GET (every redirect hop re-validated) is issued against https://<domain>, and the response is graded on three axes:

• Security headers — HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, and the cross-origin isolation trio (COOP/COEP/CORP). Each gets a HeaderVerdict plus an advisory note explaining why it scored what it did.
• Cookies — every Set-Cookie is checked for Secure, HttpOnly, and SameSite, the flags whose absence turns a session cookie into an XSS or CSRF primitive.
• Disclosure — Server/X-Powered-By-style banners that hand an attacker a version number to match against a CVE list.

The verdict scale is crate::posture::PostureVerdict, so the two security reports read the same way. Scoring is a weighted sum over the headers plus bounded penalties for cookie and disclosure findings, mapped to a letter grade.

Deliberately one request, no probing: this reports what the origin volunteers to any ordinary visitor. It sends no crafted payloads, tries no paths, and never authenticates — the same non-intrusive stance as crate::status. All grading is pure and unit-tested; only the fetch is async.

Re-exports

pub use crate::posture::PostureVerdict as HeaderVerdict;

Structs

CookieFinding

The audit result for one Set-Cookie.

Disclosure

A header that discloses software or version information.

HeaderFinding

The audit result for one security header.

HeaderReport

The full HTTP security-header audit for a domain.

Constants

DEFAULT_HEADER_TIMEOUT

Default per-audit HTTP timeout, for callers with no configured value of their own (the Python bindings). The CLI passes config.http_timeout().

Functions

audit_headers

Audits the HTTP security headers served by domain.