security

Overview ¶

Package security implements security checks. It runs in two passes.

The default pass is per-page and passive: the three baseline response headers (HSTS, CSP, X-Content-Type-Options) and forms whose action downgrades to http://.

The opt-in pass is the security audit — transport-layer and cookie hygiene: the TLS protocol version and cipher suite, the certificate chain the server presented (expiry, signature and key strength, completeness), Set-Cookie attributes, and the deeper response-header policy checks (HSTS quality, framing protection, referrer policy, software version disclosure). It is enabled with WithAudit, wired to the `security_audit` config flag, so the default analyzer stays minimal.

Everything the audit inspects is server configuration, identical across every page a host serves, so audit findings are aggregated and emitted once per host — reported against the first page crawled on that host — rather than repeating on all of them. The baseline per-page checks keep their existing per-page behaviour.

The audit reads only what the crawl already fetched: it opens no extra connections and sends no probes. That bounds what it can see — a certificate so broken that Go's TLS stack refuses the handshake produces a fetch error, not an audit finding.