🥮 mooncakes.io

moonsec-headers

MoonBit native HTTP security header and CSP audit library

security
headers
csp
audit
http
wasm
moon add HYF-ai2006/moonsec-headers@0.1.0
Download zip
Version
0.1.0
License
MIT
Repository
Last updated
5 hours ago
Downloads
2
README

#moonsec-headers

MoonBit CI

moonsec-headers 是一个 MoonBit 原生 HTTP 安全响应头审计库。它把原始响应头文本解析为结构化数据，检查 Content-Security-Policy、HSTS、点击劫持防护、MIME sniffing 防护、Referrer-Policy、Permissions-Policy、跨源隔离和高风险 CORS 组合，并提供深度 CSP source 分析、安全场景 profile、策略生成器以及 Markdown、JSON、Checklist、SARIF-like 等报告输出。

#解决的问题

Web 服务、Wasm 边缘函数、静态站点发布脚本和内部安全工具经常需要判断响应头是否具备基本防护。直接手写字符串判断容易遗漏大小写、重复头、CSP fallback、重复 directive、无效 max-age 等细节。moonsec-headers 提供可复用的解析器、规则审计器和报告模型，适合被其他 MoonBit 工具集成。

项目当前有效 MoonBit 源码超过 4k 行，核心功能、扩展 profile、策略生成器和测试均可本地构建运行。

#适用场景

  • MoonBit Web/Wasm 项目的发布前安全检查。
  • 静态站点、API 网关、边缘函数的离线 header fixture 审计。
  • CI 中对响应头快照进行回归测试。
  • 教学项目中展示 CSP 与常见安全头的最小规则集。
  • 安全工具作者需要一个无网络依赖的 MoonBit 基础库。

#安装方式

Mooncakes 包名：

HYF-ai2006/moonsec-headers

发布到个人 Mooncakes owner 后，可在项目中添加：

moon add HYF-ai2006/moonsec-headers

然后在 moon.pkg 中导入：

import {
  "HYF-ai2006/moonsec-headers" @headers
}

#最小使用示例

let raw = [
  "Content-Security-Policy: default-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'",
  "Strict-Transport-Security: max-age=31536000; includeSubDomains",
  "X-Content-Type-Options: nosniff",
  "Referrer-Policy: strict-origin-when-cross-origin",
  "Permissions-Policy: camera=(), microphone=(), geolocation=()",
].join("\n")

let report = @headers.audit_headers(raw)
println(report.to_markdown())

#生成安全响应头基线

let plan = @headers.static_site_header_plan()
println(plan.to_header_block())

let report = plan.audit()
println(report.render(@headers.PlainText))

也可以按场景生成：

let spa = @headers.spa_header_plan(
  "https://api.example.test",
  "https://assets.example.test",
)
let assessment = spa.assess_with_profile("spa-app")

#本地运行

moon check
moon build
moon test
moon run cmd/main
moon publish --dry-run

cmd/main 使用内置的不安全响应头 fixture，输出一份 Markdown 审计报告，适合作为 CI smoke test。

#核心 API

  • parse_header_line(line, line_number)：解析单行 HTTP header，返回结构化 Header 或 ParseIssue。
  • parse_headers(raw)：解析多行响应头文本，保留重复 header 值并记录格式问题。
  • parse_csp(value)：解析 CSP directive、值、重复 directive 和 CSP 解析问题。
  • audit_headers(raw)：从原始响应头文本生成 AuditReport。
  • audit_header_set(headers)：从已解析的 HeaderSet 生成审计报告。
  • audit_headers_with_csp_analysis(raw)：在基础审计外追加深度 CSP source 风险分析。
  • analyze_csp_header(value)：对 CSP source expression 做分类、fallback 分析和风险观察。
  • profile_catalog() / profile_lookup(key)：获取 static-site、spa-app、api-service、admin-console 等安全 profile。
  • SecurityProfile::score_headers(headers)：按指定场景 profile 评估响应头是否达到基线。
  • ProfileAssessment::meets_required()：判断 profile 的必需项是否全部满足。
  • RequirementMode：支持 exact、contains、contains-any、prefix、any-of 和 absent 匹配模式。
  • static_site_header_plan() / spa_header_plan(...) / api_service_header_plan()：生成可直接使用的安全响应头方案。
  • CspBuilder：以结构化方式生成 CSP directive，支持追加、替换、校验和分析。
  • AuditReport::to_markdown()：导出 Markdown 表格报告。
  • AuditReport::to_json_string()：导出 JSON 报告。
  • AuditReport::passes(score) / has_blocking_findings()：为 CI 或发布流程提供质量门禁判断。
  • AuditReport::render(format)：导出 Markdown、PlainText、Checklist、JSON 或 SARIF-like 报告。
  • recommended_baseline()：返回一组可作为起点的安全响应头。
  • sample_insecure_headers()：返回 CLI 与测试使用的不安全 fixture。

#支持范围

  • Header 名大小写归一化、空白裁剪、重复 header 聚合。
  • CSP directive 解析、default-src fallback、重复 directive 识别。
  • CSP 中 unsafe-inline、unsafe-eval、通配 script 源、HTTP script 源、缺少 object-src/base-uri/frame-ancestors 的风险提示。
  • HSTS max-age 解析、短 max-age、缺失 includeSubDomains。
  • X-Content-Type-Options、X-Frame-Options、Referrer-Policy、Permissions-Policy。
  • COOP/CORP 的基础值检查。
  • Access-Control-Allow-Origin: * 与 credential CORS 组合检查。
  • Markdown 与 JSON 报告导出。
  • CSP source expression 分类：'self'、'none'、nonce、hash、strict-dynamic、HTTP/HTTPS scheme、data/blob/filesystem、通配源和 host 源。
  • 深度 CSP 观察：脚本执行源、样式源、对象源、表单提交、frame ancestors、connect-src、混合内容升级和 CSP violation reporting。
  • 12 个安全 profile：static-site、spa-app、api-service、admin-console、docs-site、embedded-widget、internal-dashboard、file-download、wasm-edge、public-portal、login-flow、media-cdn。
  • 安全响应头策略生成器：静态站、SPA、API、管理后台、登录页、媒体 CDN。
  • Markdown、PlainText、Checklist、JSON、SARIF-like 报告输出。

#暂不支持范围

  • 不发起网络请求，不抓取真实站点。
  • 不实现完整浏览器级 CSP 解释器。
  • 不验证 nonce/hash 是否与 HTML 内容匹配。
  • 不根据业务自动决定第三方域名 allowlist，调用方需要显式传入。
  • 不解析 HTTP/2 伪头或二进制协议帧。
  • 不替代专业渗透测试、合规认证或浏览器安全模型。

#测试与验收

当前测试覆盖：

  • 正常 header 输入。
  • 错误 header 输入。
  • 空输入边界。
  • 重复 header 聚合。
  • CSP directive 数据结构转换。
  • 核心审计规则。
  • Markdown/JSON 导出。
  • 深度 CSP source 分类、fallback 和高风险策略观察。
  • 安全 profile 评估。
  • 策略生成器、header plan 渲染、校验和 profile assessment。
  • Markdown、PlainText、Checklist、JSON、SARIF-like 输出。
  • CLI smoke fixture。

当前本地测试：23 个测试全部通过。

运行命令：

moon check
moon build
moon test
moon run cmd/main
moon publish --dry-run

CI 使用 moon fmt --check、moon check --deny-warn、moon build、moon test --deny-warn、git diff --check 和 moon run cmd/main。验收前的完整复现顺序见 docs/release-checklist.md，贡献和问题反馈约定见 CONTRIBUTING.md。

#开源许可证与第三方说明

本项目使用 MIT 许可证。核心功能为原创 MoonBit 实现，不移植第三方源码，不包含图片、音频、字体或来源不明素材。项目仅依赖 MoonBit 官方 core 包。

#
AuditReport

source
pub(all) struct AuditReport {
  score : Int
  grade : String
  findings : Array[Finding]
  headers : HeaderSet
} derive(Eq, 
Debug)

#
AuditReport::count_by_severity

source
fn AuditReport::count_by_severity(self : AuditReport, severity : Severity) -> Int

#
AuditReport::findings_by_header

source
fn AuditReport::findings_by_header(self : AuditReport, name : StringView) -> Array[Finding]

#
AuditReport::findings_by_severity

source
fn AuditReport::findings_by_severity(self : AuditReport, severity : Severity) -> Array[Finding]

#
AuditReport::has_blocking_findings

source
fn AuditReport::has_blocking_findings(self : AuditReport) -> Bool

Returns true when the report contains no Critical or High finding.

#
AuditReport::has_finding

source
fn AuditReport::has_finding(self : AuditReport, id : StringView) -> Bool

#
AuditReport::is_clean

source
fn AuditReport::is_clean(self : AuditReport) -> Bool

#
AuditReport::passes

source
fn AuditReport::passes(self : AuditReport, minimum_score : Int) -> Bool

Returns true when the report reaches the caller's score threshold.

The threshold is supplied by the caller because a release gate may be stricter than a local development check.

#
AuditReport::render

source
fn AuditReport::render(self : AuditReport, format : ReportFormat, options? : RenderOptions) -> String

#
AuditReport::rendered_findings

source
fn AuditReport::rendered_findings(self : AuditReport, options : RenderOptions) -> Array[Finding]

#
AuditReport::severity_breakdown

source
fn AuditReport::severity_breakdown(self : AuditReport) -> String

#
AuditReport::to_checklist_markdown

source
fn AuditReport::to_checklist_markdown(self : AuditReport, options : RenderOptions) -> String

#
AuditReport::to_detailed_markdown

source
fn AuditReport::to_detailed_markdown(self : AuditReport, options : RenderOptions) -> String

#
AuditReport::to_issue_summary

source
fn AuditReport::to_issue_summary(self : AuditReport) -> String

#
AuditReport::to_json_string

source
fn AuditReport::to_json_string(self : AuditReport) -> String

#
AuditReport::to_markdown

source
fn AuditReport::to_markdown(self : AuditReport) -> String

#
AuditReport::to_plain_text

source
fn AuditReport::to_plain_text(self : AuditReport, options : RenderOptions) -> String

#
AuditReport::to_sarif_string

source
fn AuditReport::to_sarif_string(self : AuditReport, options : RenderOptions) -> String

#
AuditReport::top_findings

source
fn AuditReport::top_findings(self : AuditReport, limit : Int) -> Array[Finding]

#
CspAnalysis

source
pub(all) struct CspAnalysis {
  score : Int
  policy : CspPolicy
  observations : Array[CspObservation]
  directives : Array[CspDirectiveSummary]
  sources : Array[CspSourceExpression]
} derive(Eq, 
Debug)

#
CspAnalysis::count_by_severity

source
fn CspAnalysis::count_by_severity(self : CspAnalysis, severity : Severity) -> Int

#
CspAnalysis::has_observation

source
fn CspAnalysis::has_observation(self : CspAnalysis, id : StringView) -> Bool

#
CspAnalysis::summary

source
fn CspAnalysis::summary(self : CspAnalysis) -> String

#
CspAnalysis::to_findings

source
fn CspAnalysis::to_findings(self : CspAnalysis) -> Array[Finding]

#
CspAnalysis::to_json_string

source
fn CspAnalysis::to_json_string(self : CspAnalysis) -> String

#
CspAnalysis::to_markdown

source
fn CspAnalysis::to_markdown(self : CspAnalysis) -> String

#
CspBuilder

source
pub(all) struct CspBuilder {
  report_only : Bool
  directives : Array[CspDirectiveSpec]
} derive(Eq, 
Debug)

#
CspBuilder::analyze

source
fn CspBuilder::analyze(self : CspBuilder) -> CspAnalysis

#
CspBuilder::append_value

source
fn CspBuilder::append_value(self : CspBuilder, name : StringView, value : StringView) -> CspBuilder

#
CspBuilder::as_enforcing

source
fn CspBuilder::as_enforcing(self : CspBuilder) -> CspBuilder

#
CspBuilder::as_report_only

source
fn CspBuilder::as_report_only(self : CspBuilder) -> CspBuilder

#
CspBuilder::copy_directives

source
fn CspBuilder::copy_directives(self : CspBuilder) -> Array[CspDirectiveSpec]

#
CspBuilder::has_directive

source
fn CspBuilder::has_directive(self : CspBuilder, name : StringView) -> Bool

#
CspBuilder::header_name

source
fn CspBuilder::header_name(self : CspBuilder) -> String

#
CspBuilder::parse_policy

source
fn CspBuilder::parse_policy(self : CspBuilder) -> CspPolicy

#
CspBuilder::render

source
fn CspBuilder::render(self : CspBuilder) -> String

#
CspBuilder::to_header_line

source
fn CspBuilder::to_header_line(self : CspBuilder) -> String

#
CspBuilder::to_header_pair

source
fn CspBuilder::to_header_pair(self : CspBuilder) -> HeaderPair

#
CspBuilder::validate

source
fn CspBuilder::validate(self : CspBuilder) -> PolicyValidation

#
CspBuilder::values_for

source
fn CspBuilder::values_for(self : CspBuilder, name : StringView) -> Array[String]

#
CspBuilder::with_directive

source
fn CspBuilder::with_directive(self : CspBuilder, name : StringView, values : Array[String]) -> CspBuilder

#
CspBuilder::without_directive

source
fn CspBuilder::without_directive(self : CspBuilder, name : StringView) -> CspBuilder

#
CspDirectiveFamily

source
pub(all) enum CspDirectiveFamily {
  CspFamilyFetch
  CspFamilyDocument
  CspFamilyNavigation
  CspFamilyReporting
  CspFamilySandbox
  CspFamilyMixedContent
  CspFamilyOther
} derive(Eq, 
Debug)

#
CspDirectiveFamily::label

source
fn CspDirectiveFamily::label(self : CspDirectiveFamily) -> String

#
CspDirectiveSpec

source
pub(all) struct CspDirectiveSpec {
  name : String
  values : Array[String]
} derive(Eq, 
Debug)

#
CspDirectiveSpec::render

source
fn CspDirectiveSpec::render(self : CspDirectiveSpec) -> String

#
CspDirectiveSummary

source
pub(all) struct CspDirectiveSummary {
  name : String
  family : CspDirectiveFamily
  explicit : Bool
  value_count : Int
  source_count : Int
  has_none : Bool
  has_self : Bool
  has_wildcard : Bool
  has_http : Bool
  has_inline : Bool
  has_eval : Bool
  has_nonce : Bool
  has_hash : Bool
  notes : Array[String]
} derive(Eq, 
Debug)

#
CspDirectiveSummary::stance

source
fn CspDirectiveSummary::stance(self : CspDirectiveSummary) -> String

#
CspDirectiveSummary::to_json_string

source
fn CspDirectiveSummary::to_json_string(self : CspDirectiveSummary) -> String

#
CspDirectiveSummary::to_markdown_row

source
fn CspDirectiveSummary::to_markdown_row(self : CspDirectiveSummary) -> String

#
CspObservation

source
pub(all) struct CspObservation {
  id : String
  severity : Severity
  directive : String
  source : String
  message : String
  recommendation : String
} derive(Eq, 
Debug)

#
CspObservation::to_finding

source
fn CspObservation::to_finding(self : CspObservation) -> Finding

#
CspPolicy

source
pub(all) struct CspPolicy {
  raw : String
  directives : Array[Directive]
  duplicates : Array[String]
  issues : Array[ParseIssue]
} derive(Eq, 
Debug)

#
CspPolicy::all_sources

source
fn CspPolicy::all_sources(self : CspPolicy) -> Array[CspSourceExpression]

#
CspPolicy::directive

source
fn CspPolicy::directive(self : CspPolicy, name : StringView) -> Directive?

#
CspPolicy::directive_names

source
fn CspPolicy::directive_names(self : CspPolicy) -> Array[String]

#
CspPolicy::directive_summary

source
fn CspPolicy::directive_summary(self : CspPolicy, directive : StringView) -> CspDirectiveSummary

#
CspPolicy::effective_source_values

source
fn CspPolicy::effective_source_values(self : CspPolicy, directive : StringView) -> Array[String]

#
CspPolicy::effective_values

source
fn CspPolicy::effective_values(self : CspPolicy, name : StringView) -> Array[String]

#
CspPolicy::explicit_sources_for

source
fn CspPolicy::explicit_sources_for(self : CspPolicy, directive : StringView) -> Array[CspSourceExpression]

#
CspPolicy::has_directive

source
fn CspPolicy::has_directive(self : CspPolicy, name : StringView) -> Bool

#
CspPolicy::has_hash

source
fn CspPolicy::has_hash(self : CspPolicy) -> Bool

#
CspPolicy::has_nonce

source
fn CspPolicy::has_nonce(self : CspPolicy) -> Bool

#
CspPolicy::has_strict_dynamic

source
fn CspPolicy::has_strict_dynamic(self : CspPolicy) -> Bool

#
CspPolicy::sources_for

source
fn CspPolicy::sources_for(self : CspPolicy, directive : StringView) -> Array[CspSourceExpression]

#
CspPolicy::values_for

source
fn CspPolicy::values_for(self : CspPolicy, name : StringView) -> Array[String]

#
CspSourceExpression

source
pub(all) struct CspSourceExpression {
  directive : String
  raw : String
  normalized : String
  kind : CspSourceKind
  secure_transport : Bool
  broad : Bool
  note : String
} derive(Eq, 
Debug)

#
CspSourceExpression::risk_label

source
fn CspSourceExpression::risk_label(self : CspSourceExpression) -> String

#
CspSourceExpression::to_json_string

source
fn CspSourceExpression::to_json_string(self : CspSourceExpression) -> String

#
CspSourceExpression::to_markdown_row

source
fn CspSourceExpression::to_markdown_row(self : CspSourceExpression) -> String

#
CspSourceKind

source
pub(all) enum CspSourceKind {
  CspSourceNone
  CspSourceSelf
  CspSourceUnsafeInline
  CspSourceUnsafeEval
  CspSourceStrictDynamic
  CspSourceNonce
  CspSourceHash
  CspSourceHttpsScheme
  CspSourceHttpScheme
  CspSourceDataScheme
  CspSourceBlobScheme
  CspSourceFilesystemScheme
  CspSourceWildcard
  CspSourceHost
  CspSourceKeyword
  CspSourceUnknown
} derive(Eq, 
Debug)

Deeper Content-Security-Policy source analysis.

The core parser keeps CSP syntax lightweight. This module adds a second layer that classifies source expressions and explains why a policy is broad or narrow enough for production review.

#
CspSourceKind::label

source
fn CspSourceKind::label(self : CspSourceKind) -> String

#
Directive

source
pub(all) struct Directive {
  name : String
  values : Array[String]
} derive(Eq, 
Debug)

#
Finding

source
pub(all) struct Finding {
  id : String
  severity : Severity
  header : String
  message : String
  evidence : String
  remediation : String
} derive(Eq, 
Debug)

#
Finding::to_markdown_row

source
fn Finding::to_markdown_row(self : Finding) -> String

#
Finding::to_plain_text_line

source
fn Finding::to_plain_text_line(self : Finding) -> String

pub(all) struct Header {
  name : String
  value : String
  line : Int
} derive(Eq, 
Debug)

#
HeaderPair

source
pub(all) struct HeaderPair {
  name : String
  value : String
} derive(Eq, 
Debug)

#
HeaderPair::line

source
fn HeaderPair::line(self : HeaderPair) -> String

#
HeaderPair::normalized_name

source
fn HeaderPair::normalized_name(self : HeaderPair) -> String

#
HeaderPair::to_markdown_row

source
fn HeaderPair::to_markdown_row(self : HeaderPair) -> String

#
HeaderPlan

source
pub(all) struct HeaderPlan {
  kind : HeaderPlanKind
  title : String
  scenario : String
  headers : Array[HeaderPair]
  notes : Array[String]
} derive(Eq, 
Debug)

#
HeaderPlan::assess_with_profile

source
fn HeaderPlan::assess_with_profile(self : HeaderPlan, key : StringView) -> ProfileAssessment?

#
HeaderPlan::audit

source
fn HeaderPlan::audit(self : HeaderPlan) -> AuditReport

#
HeaderPlan::audit_deep

source
fn HeaderPlan::audit_deep(self : HeaderPlan) -> AuditReport

#
HeaderPlan::to_header_block

source
fn HeaderPlan::to_header_block(self : HeaderPlan) -> String

#
HeaderPlan::to_json_string

source
fn HeaderPlan::to_json_string(self : HeaderPlan) -> String

#
HeaderPlan::to_markdown

source
fn HeaderPlan::to_markdown(self : HeaderPlan) -> String

#
HeaderPlan::validate

source
fn HeaderPlan::validate(self : HeaderPlan) -> PolicyValidation

#
HeaderPlanKind

source
pub(all) enum HeaderPlanKind {
  HeaderPlanStaticSite
  HeaderPlanSpaApp
  HeaderPlanApiService
  HeaderPlanAdminConsole
  HeaderPlanLoginFlow
  HeaderPlanMediaCdn
  HeaderPlanCustom
} derive(Eq, 
Debug)

Header and CSP policy builders.

This module lets callers generate deterministic response-header baselines instead of copying long strings between services and CI fixtures.

#
HeaderPlanKind::label

source
fn HeaderPlanKind::label(self : HeaderPlanKind) -> String

#
HeaderRequirement

source
pub(all) struct HeaderRequirement {
  name : String
  expected : String
  mode : RequirementMode
  required : Bool
  severity : Severity
  rationale : String
} derive(Eq, 
Debug)

#
HeaderSet

source
pub(all) struct HeaderSet {
  headers : Array[Header]
  index : Map[String, Array[String]]
  issues : Array[ParseIssue]
} derive(Eq, 
Debug)

#
HeaderSet::get

source
fn HeaderSet::get(self : HeaderSet, name : StringView) -> String?

#
HeaderSet::get_all

source
fn HeaderSet::get_all(self : HeaderSet, name : StringView) -> Array[String]

#
HeaderSet::has

source
fn HeaderSet::has(self : HeaderSet, name : StringView) -> Bool

#
HeaderSet::security_headers

source
fn HeaderSet::security_headers(self : HeaderSet) -> Array[Header]

#
HstsConfig

source
pub(all) struct HstsConfig {
  max_age : Int
  include_subdomains : Bool
  preload : Bool
} derive(Eq, 
Debug)

#
HstsConfig::render

source
fn HstsConfig::render(self : HstsConfig) -> String

#
HstsConfig::to_header_pair

source
fn HstsConfig::to_header_pair(self : HstsConfig) -> HeaderPair

#
ParseIssue

source
pub(all) struct ParseIssue {
  kind : ParseIssueKind
  line : Int
  name : String
  message : String
} derive(Eq, 
Debug)

#
ParseIssueKind

source
pub(all) enum ParseIssueKind {
  EmptyName
  MissingColon
  ControlCharacter
  EmptyDirective
  DuplicateDirective
  InvalidToken
} derive(Eq, 
Debug)

#
ParseIssueKind::label

source
fn ParseIssueKind::label(self : ParseIssueKind) -> String

#
PolicyValidation

source
pub(all) struct PolicyValidation {
  ok : Bool
  messages : Array[ValidationMessage]
} derive(Eq, 
Debug)

#
PolicyValidation::error_count

source
fn PolicyValidation::error_count(self : PolicyValidation) -> Int

#
PolicyValidation::note_count

source
fn PolicyValidation::note_count(self : PolicyValidation) -> Int

#
PolicyValidation::to_markdown

source
fn PolicyValidation::to_markdown(self : PolicyValidation) -> String

#
PolicyValidation::warning_count

source
fn PolicyValidation::warning_count(self : PolicyValidation) -> Int

#
ProfileAssessment

source
pub(all) struct ProfileAssessment {
  profile_key : String
  score : Int
  matched : Int
  missing : Int
  weak : Int
  conflict : Int
  optional : Int
  findings : Array[ProfileFinding]
} derive(Eq, 
Debug)

#
ProfileAssessment::meets_required

source
fn ProfileAssessment::meets_required(self : ProfileAssessment) -> Bool

Returns true when all required profile checks are satisfied.

#
ProfileAssessment::recommendations

source
fn ProfileAssessment::recommendations(self : ProfileAssessment) -> Array[String]

#
ProfileAssessment::summary

source
fn ProfileAssessment::summary(self : ProfileAssessment) -> String

#
ProfileAssessment::to_checklist

source
fn ProfileAssessment::to_checklist(self : ProfileAssessment) -> String

#
ProfileAssessment::to_json_string

source
fn ProfileAssessment::to_json_string(self : ProfileAssessment) -> String

#
ProfileAssessment::to_markdown

source
fn ProfileAssessment::to_markdown(self : ProfileAssessment) -> String

#
ProfileAssessment::to_plain_text

source
fn ProfileAssessment::to_plain_text(self : ProfileAssessment) -> String

#
ProfileAssessment::to_recommendations_markdown

source
fn ProfileAssessment::to_recommendations_markdown(self : ProfileAssessment) -> String

#
ProfileFinding

source
pub(all) struct ProfileFinding {
  name : String
  status : ProfileStatus
  actual : String?
  expected : String
  severity : Severity
  rationale : String
} derive(Eq, 
Debug)

#
ProfileKind

source
pub(all) enum ProfileKind {
  StaticSite
  SpaApp
  ApiService
  AdminConsole
  DocsSite
  EmbeddedWidget
  InternalDashboard
  FileDownload
  WasmEdge
  PublicPortal
  LoginFlow
  MediaCdn
} derive(Eq, 
Debug)

#
ProfileKind::label

source
fn ProfileKind::label(self : ProfileKind) -> String

#
ProfileStatus

source
pub(all) enum ProfileStatus {
  Satisfied
  Missing
  Weak
  Conflict
  Optional
} derive(Eq, 
Debug)

#
ProfileStatus::label

source
fn ProfileStatus::label(self : ProfileStatus) -> String

#
RenderOptions

source
pub(all) struct RenderOptions {
  title : String
  limit : Int
  include_evidence : Bool
  include_remediation : Bool
  sort_by_severity : Bool
} derive(Eq, 
Debug)

#
ReportFormat

source
pub(all) enum ReportFormat {
  Markdown
  PlainText
  Checklist
  Json
  Sarif
} derive(Eq, 
Debug)

Additional renderers for audit reports and profile assessments.

#
RequirementMode

source
pub(all) enum RequirementMode {
  Exact
  Contains
  ContainsAny
  Prefix
  AnyOf
  Absent
} derive(Eq, 
Debug)

Security baseline profiles for common deployment shapes.

The generic audit report tells you what is wrong. These profiles tell you what a sensible target configuration looks like for different scenarios.

#
RequirementMode::label

source
fn RequirementMode::label(self : RequirementMode) -> String

#
SecurityProfile

source
pub(all) struct SecurityProfile {
  kind : ProfileKind
  key : String
  title : String
  audience : String
  summary : String
  requirements : Array[HeaderRequirement]
} derive(Eq, 
Debug)

#
SecurityProfile::find_requirement

source
fn SecurityProfile::find_requirement(self : SecurityProfile, name : StringView) -> HeaderRequirement?

#
SecurityProfile::optional_count

source
fn SecurityProfile::optional_count(self : SecurityProfile) -> Int

#
SecurityProfile::optional_headers

source
fn SecurityProfile::optional_headers(self : SecurityProfile) -> Array[String]

#
SecurityProfile::required_count

source
fn SecurityProfile::required_count(self : SecurityProfile) -> Int

#
SecurityProfile::required_headers

source
fn SecurityProfile::required_headers(self : SecurityProfile) -> Array[String]

#
SecurityProfile::score_headers

source
fn SecurityProfile::score_headers(self : SecurityProfile, headers : HeaderSet) -> ProfileAssessment

#
SecurityProfile::to_markdown

source
fn SecurityProfile::to_markdown(self : SecurityProfile) -> String

#
Severity

source
pub(all) enum Severity {
  Critical
  High
  Medium
  Low
  Info
} derive(Eq, 
Debug)

moonsec-headers audits HTTP response security headers from plain text.

The library intentionally accepts raw header blocks instead of performing network requests. That keeps it deterministic for CI, Wasm, and offline resource pipelines.

#
Severity::label

source
fn Severity::label(self : Severity) -> String

#
Severity::weight

source
fn Severity::weight(self : Severity) -> Int

#
ValidationLevel

source
pub(all) enum ValidationLevel {
  ValidationError
  ValidationWarning
  ValidationNote
} derive(Eq, 
Debug)

#
ValidationLevel::label

source
fn ValidationLevel::label(self : ValidationLevel) -> String

#
ValidationMessage

source
pub(all) struct ValidationMessage {
  level : ValidationLevel
  field : String
  message : String
} derive(Eq, 
Debug)

#
admin_console_csp

source
fn admin_console_csp(api_origin : StringView) -> CspBuilder

#
admin_console_header_plan

source
fn admin_console_header_plan(api_origin : StringView) -> HeaderPlan

#
admin_console_profile

source
fn admin_console_profile() -> SecurityProfile

#
analyze_csp_header

source
fn analyze_csp_header(value : StringView) -> CspAnalysis

#
analyze_csp_policy

source
fn analyze_csp_policy(policy : CspPolicy) -> CspAnalysis

#
api_service_csp

source
fn api_service_csp() -> CspBuilder

#
api_service_header_plan

source
fn api_service_header_plan() -> HeaderPlan

#
api_service_profile

source
fn api_service_profile() -> SecurityProfile

#
audit_header_set

source
fn audit_header_set(headers : HeaderSet) -> AuditReport

#
audit_headers

source
fn audit_headers(raw : StringView) -> AuditReport

#
audit_headers_with_csp_analysis

source
fn audit_headers_with_csp_analysis(raw : StringView) -> AuditReport

#
cache_control_header

source
fn cache_control_header(value : StringView) -> HeaderPair

#
classify_csp_source

source
fn classify_csp_source(token : StringView) -> CspSourceKind

#
content_disposition_header

source
fn content_disposition_header(value : StringView) -> HeaderPair

#
cross_origin_embedder_policy_header

source
fn cross_origin_embedder_policy_header(value : StringView) -> HeaderPair

#
cross_origin_opener_policy_header

source
fn cross_origin_opener_policy_header(value : StringView) -> HeaderPair

#
cross_origin_resource_policy_header

source
fn cross_origin_resource_policy_header(value : StringView) -> HeaderPair

#
csp_all_interesting_directives

source
fn csp_all_interesting_directives() -> Array[String]

#
csp_directive_family

source
fn csp_directive_family(name : StringView) -> CspDirectiveFamily

#
csp_document_directive

source
fn csp_document_directive(name : StringView) -> Bool

#
csp_document_directives

source
fn csp_document_directives() -> Array[String]

#
csp_fallback_directive

source
fn csp_fallback_directive(directive : StringView) -> String?

#
csp_mixed_content_directive

source
fn csp_mixed_content_directive(name : StringView) -> Bool

#
csp_mixed_content_directives

source
fn csp_mixed_content_directives() -> Array[String]

#
csp_navigation_directive

source
fn csp_navigation_directive(name : StringView) -> Bool

#
csp_navigation_directives

source
fn csp_navigation_directives() -> Array[String]

#
csp_report_only_builder

source
fn csp_report_only_builder() -> CspBuilder

#
csp_reporting_directive

source
fn csp_reporting_directive(name : StringView) -> Bool

#
csp_reporting_directives

source
fn csp_reporting_directives() -> Array[String]

#
csp_source_directive

source
fn csp_source_directive(name : StringView) -> Bool

#
csp_source_directives

source
fn csp_source_directives() -> Array[String]

#
csp_source_expression

source
fn csp_source_expression(directive : StringView, token : StringView) -> CspSourceExpression

#
default_render_options

source
fn default_render_options() -> RenderOptions

#
docs_site_profile

source
fn docs_site_profile() -> SecurityProfile

#
embedded_widget_profile

source
fn embedded_widget_profile() -> SecurityProfile

#
file_download_profile

source
fn file_download_profile() -> SecurityProfile

#
grade_score

source
fn grade_score(score : Int) -> String

#
header_pair

source
fn header_pair(name : StringView, value : StringView) -> HeaderPair

#
header_plan

source
fn header_plan(kind : HeaderPlanKind, title : StringView, scenario : StringView, headers : Array[HeaderPair], notes : Array[String]) -> HeaderPlan

#
header_plan_by_key

source
fn header_plan_by_key(key : StringView) -> HeaderPlan?

#
header_plan_catalog

source
fn header_plan_catalog() -> Array[HeaderPlan]

#
header_plan_catalog_markdown

source
fn header_plan_catalog_markdown() -> String

#
header_plan_keys

source
fn header_plan_keys() -> Array[String]

#
hsts_config

source
fn hsts_config(max_age : Int, include_subdomains : Bool, preload : Bool) -> HstsConfig

#
hsts_header

source
fn hsts_header(max_age : Int, include_subdomains : Bool, preload : Bool) -> HeaderPair

#
internal_dashboard_profile

source
fn internal_dashboard_profile() -> SecurityProfile

#
is_known_security_header

source
fn is_known_security_header(name : StringView) -> Bool

#
login_flow_csp

source
fn login_flow_csp(identity_origin : StringView) -> CspBuilder

#
login_flow_header_plan

source
fn login_flow_header_plan(identity_origin : StringView) -> HeaderPlan

#
login_flow_profile

source
fn login_flow_profile() -> SecurityProfile

#
media_cdn_csp

source
fn media_cdn_csp() -> CspBuilder

#
media_cdn_header_plan

source
fn media_cdn_header_plan() -> HeaderPlan

#
media_cdn_profile

source
fn media_cdn_profile() -> SecurityProfile

#
new_csp_builder

source
fn new_csp_builder() -> CspBuilder

#
no_detail_render_options

source
fn no_detail_render_options() -> RenderOptions

#
normalize_header_name

source
fn normalize_header_name(name : StringView) -> String

#
parse_csp

source
fn parse_csp(value : StringView) -> CspPolicy

#
parse_header_line

source
fn parse_header_line(line : StringView, line_number : Int) -> Result[Header, ParseIssue]

#
parse_headers

source
fn parse_headers(raw : StringView) -> HeaderSet

#
permissions_policy_header

source
fn permissions_policy_header(disabled_features : Array[String]) -> HeaderPair

#
profile

source
fn profile(kind : ProfileKind, key : StringView, title : StringView, audience : StringView, summary : StringView, requirements : Array[HeaderRequirement]) -> SecurityProfile

#
profile_assessment_catalog

source
fn profile_assessment_catalog(profile : SecurityProfile) -> Array[String]

#
profile_audiences_markdown

source
fn profile_audiences_markdown() -> String

#
profile_catalog

source
fn profile_catalog() -> Array[SecurityProfile]

#
profile_catalog_markdown

source
fn profile_catalog_markdown() -> String

#
profile_count

source
fn profile_count() -> Int

#
profile_gap_headers

source
fn profile_gap_headers(profile : SecurityProfile, headers : HeaderSet) -> Array[String]

#
profile_is_strict

source
fn profile_is_strict(profile : SecurityProfile) -> Bool

#
profile_keys

source
fn profile_keys() -> Array[String]

#
profile_lookup

source
fn profile_lookup(key : StringView) -> SecurityProfile?

#
profile_names_markdown

source
fn profile_names_markdown() -> String

#
profile_summaries_markdown

source
fn profile_summaries_markdown() -> String

#
profile_titles

source
fn profile_titles() -> Array[String]

#
public_portal_profile

source
fn public_portal_profile() -> SecurityProfile

fn recommended_baseline() -> String

fn recommended_hsts_config() -> HstsConfig

#
referrer_policy_header

source
fn referrer_policy_header(value : StringView) -> HeaderPair

#
requirement

source
fn requirement(name : StringView, expected : StringView, mode? : RequirementMode, required? : Bool, severity? : Severity, rationale? : StringView) -> HeaderRequirement

#
requirement_matches

source
fn requirement_matches(req : HeaderRequirement, actual : StringView) -> Bool

#
sample_insecure_headers

source
fn sample_insecure_headers() -> String

#
score_findings

source
fn score_findings(findings : Array[Finding]) -> Int

#
spa_app_profile

source
fn spa_app_profile() -> SecurityProfile

#
spa_csp

source
fn spa_csp(api_origin : StringView, asset_origin : StringView) -> CspBuilder

#
spa_header_plan

source
fn spa_header_plan(api_origin : StringView, asset_origin : StringView) -> HeaderPlan

#
static_site_csp

source
fn static_site_csp() -> CspBuilder

#
static_site_header_plan

source
fn static_site_header_plan() -> HeaderPlan

#
static_site_profile

source
fn static_site_profile() -> SecurityProfile

#
strict_profiles

source
fn strict_profiles() -> Array[SecurityProfile]

#
wasm_edge_profile

source
fn wasm_edge_profile() -> SecurityProfile

#
x_content_type_options_header

source
fn x_content_type_options_header() -> HeaderPair

#
x_frame_options_header

source
fn x_frame_options_header(value : StringView) -> HeaderPair

Source Files

Powered by MoonBit

Site sourceReport issuePackagesBuild queueSkillsStatistics

© 2026 mooncakes.io