HTTP 헤더 분석기 - 보안 헤더 파싱 & 감사 온라인

// HTTP Header Parser and Security Analyzer

function parseHttpHeaders(rawHeaders) {
  const headers = [];
  for (const line of rawHeaders.split('\n')) {
    let cleaned = line.trim();
    if (!cleaned) continue;
    if (/^HTTP\/[\d.]+\s+\d+/.test(cleaned)) continue;
    if (/^(GET|POST|PUT|DELETE|PATCH|HEAD|OPTIONS)\s+/.test(cleaned)) continue;
    cleaned = cleaned.replace(/^[<>]\s*/, '');
    if (!cleaned) continue;
    const i = cleaned.indexOf(':');
    if (i === -1) continue;
    const name = cleaned.substring(0, i).trim();
    const value = cleaned.substring(i + 1).trim();
    if (name) headers.push({ name, value });
  }
  return headers;
}

const SECURITY_CHECKS = [
  { header: 'strict-transport-security', label: 'HSTS', weight: 15 },
  { header: 'content-security-policy', label: 'CSP', weight: 20 },
  { header: 'x-frame-options', label: 'X-Frame-Options', weight: 10 },
  { header: 'x-content-type-options', label: 'X-Content-Type-Options', weight: 10 },
  { header: 'referrer-policy', label: 'Referrer-Policy', weight: 10 },
  { header: 'permissions-policy', label: 'Permissions-Policy', weight: 10 },
];

function auditSecurity(headers) {
  const map = new Map(headers.map(h => [h.name.toLowerCase(), h.value]));
  let score = 0;
  const results = [];
  for (const check of SECURITY_CHECKS) {
    const value = map.get(check.header);
    if (value) {
      score += check.weight;
      results.push({ header: check.label, status: 'pass', value });
    } else {
      results.push({ header: check.label, status: 'fail', value: null });
    }
  }
  // Check info leakage
  if (!['server', 'x-powered-by'].some(h => map.has(h))) score += 10;
  const grade = score >= 95 ? 'A+' : score >= 85 ? 'A' :
    score >= 75 ? 'B' : score >= 60 ? 'C' : score >= 40 ? 'D' : 'F';
  return { score, grade, results };
}

// Example usage
const raw = `Content-Type: text/html\nStrict-Transport-Security: max-age=31536000\nX-Frame-Options: DENY\nX-Content-Type-Options: nosniff`;
const parsed = parseHttpHeaders(raw);
const audit = auditSecurity(parsed);
console.log(`Score: ${audit.score}/100 (${audit.grade})`);