Control: Site headers must contain Content-Security-Policy

Usage

Run the control in your terminal:

steampipe check net_insights.control.security_headers_content_security_policy

Snapshot and share results via Steampipe Cloud:

steampipe login
steampipe check --share net_insights.control.security_headers_content_security_policy

net_http_request

Params

["https://github.com","https://microsoft.com"]

SQL

with available_headers as (
  select
    url,
    array_agg(header.key)
  from
    net_http_request,
    jsonb_each(response_headers) as header
  where
    url in (
      select
        jsonb_array_elements_text(to_jsonb($1 :: text [ ]))
    )
  group by
    url
)
select
  url as resource,
  case
    when array [ 'Content-Security-Policy' ] < @ array_agg then 'ok'
    else 'alarm'
  end as status,
  case
    when array [ 'Content-Security-Policy' ] < @ array_agg then url || ' contains required headers ''Content-Security-Policy''.'
    else url || ' missing required headers ''Content-Security-Policy''.'
  end as reason
from
  available_headers;