Web Cookies Scanner
All-in-one free web application security tool. Web application vulnerability and privacy scanner with support for HTTP cookies, Flash, HTML5 localStorage, sessionStorage, CANVAS, Supercookies, Evercookies. Includes a free SSL/TLS, HTML and HTTP vulnerability scanner and URL malware scanner.
Category: API Endpoint
Keywords:
Last fetched: 2020-03-30T15:52:04.475855+00:00
HTTP status: 5 Sub-resource URL
Server: DMS/1.0.42
Announces web server software and optionally version details.
Read more...
The header exposes web server version details. These server no purpose apart from making life of security auditors and hackers easier, leading them straight to exploits for this particular version of product. WebCookies.org does offer security design and penetration testing services so we can help!
-1Access-Control-Allow-Origin: *
Controls origins (websites) that are allowed to load data from this web service over JavaScript-based APIs as part of Cross-Origin Resource Sharing (CORS) standard. By default, a web browser will refuse to load data over XmlHttpRequest from a website that is not in the same origin, which is a precaution against various types of data stealing attacks. The target server has to explicitly allow the origin domain using the Access-Control-Allow-Origin (ACAO) header, or it may allow all origins to access it using a wildcard *. The latter however creates a potential security issue if the website in question is transactional and processing sensitive data, so the wildcard should be only used on websites consciously offering public APIs.
The header sets permissive AJAX access by using wildcard origin *. It may be OK if the website is a publicly accessible REST API but otherwise it should be not present at all
X-Content-Type-Options: nosniff
A non-standard but widely accepted header introduced originally by Microsoft to disable "content sniffing" or heuristic content type discovery in absence or mismatch of a proper HTTP Content-Type declaration, which led to a number of web attacks. In general, presence of the header with its only defined value of nosniff is considered as part of a properly secured HTTP response.
Fuzzy content type guessing is disabled
+1X-Robots-Tag: noindex
Controls the behavior of search engine bots and may contain most of the directives usually found in robots.txt file.
Read more...X-Frame-Options: DENY
Instructs the browser if the current website can be embedded in HTML frame by another website. Since this allows the parent website to control the framed page, this creates a potential for data theft attacks ("clickjacking") and most sensitive websites won't allow them to be framed at all (deny) or just allow parts of them to be embedded in frames created by themselves only (samesite).
Clickjacking protection is enabled
+2Expect-CT: max-age=0, report-uri="https://www.dailymotion.com/content_security_policy_report_uri"
The Expect-CT header allows sites to opt in to reporting and/or enforcement of Certificate Transparency requirements, which prevents the use of misissued certificates for that site from going unnoticed. When a site enables the Expect-CT header, they are requesting that the browser check that any certificate for that site appears in public CT logs.
Read more...Transport Layer Security (TLS) is enabled
+2X-XSS-Protection header is missing
default-src https: blob: wss: data: android-webview-video-poster: android-webview: chrome-extension: safari-extension: 'unsafe-eval' 'unsafe-inline'; report-uri https://www.dailymotion.com/content_security_policy_report_uri
Content-Security-Policy-Report-Only
Content-Security-Policy header.
No base-uri allows attackers to inject base tags which override the base URI to an attacker-controlled origin. Set to 'none' unless you need to handle tricky relative URLs scheme
Consider adding block-all-mixed-content directive if your website is only accessible over TLS and you are certain it doesn not have any legacy plaintext resources. Otherwise you may add adding upgrade-insecure-requests directive if your website may still have some legacy plaintext HTTP resources and you want them to be still available rather than blocked
The default-src data: origin allows bypassing CSP and execution of inlined untrusted scripts
Origin default-src 'unsafe-eval' allows bypassing of CSP and execution of inlined untrusted scripts. Use 'nonce-' or 'sha256-' instead
Origin default-src 'unsafe-inline' allows bypassing of CSP and execution of inlined untrusted scripts. Use 'nonce-' or 'sha256-' instead
upgrade-insecure-requests
Content-Security-Policy
No base-uri allows attackers to inject base tags which override the base URI to an attacker-controlled origin. Set to 'none' unless you need to handle tricky relative URLs scheme
Want second opinion? Try Google CSP Evaluator.
The website uses the following advertisement publisher ids: