Security headers are not configured

The application does not set the baseline security response headers. Without them a browser will not enforce HTTPS, will guess content types, and will allow the page to be framed. Headers set by a CDN or ingress are invisible to static analysis, so this rule reports lower confidence when it finds no header configuration at all.

medium likely application source OWASP A05:2021 / CWE-693

What it looks like

MEDIUM possible Security headers are not configured A05:2021 nuxt.config.ts:4:1 2 │ // This is the "no configuration anywhere" case the headers rule reports at 3 │ // lower confidence, because a CDN in front of the app might be doing it. 4 │ export default defineNuxtConfig({ │ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ no security headers configured here 5 │ devtools: { enabled: true }, 6 │ })

From nuxt.config.ts in the fixture suite. The fixture test asserts this finding.

How to fix it

Set these response headers at the edge or in the app: strict-transport-security, content-security-policy, x-content-type-options, x-frame-options, referrer-policy.

The fix for your framework

Choose the API used by your project.

Check your own repository

npx owlwarden scan --preset deep
npx owlwarden explain security-headers-missing

explain prints the rule and fixes in the terminal. It does not use the network.

All 25 rules / owlwarden