Merge pull request #10 from benbalter/loosen-headers

Loosen header checks for case-insensitivity

lib/site-inspector/headers.rb

@@ -1,34 +1,67 @@
 class SiteInspector
+
+  # the ? versions could maybe just be dropped
+  def has_cookies?
+    !!has_cookies
+  end
+
+  def strict_transport_security?
+    !!strict_transport_security
+  end
+
+  def content_security_policy?
+    !!content_security_policy
+  end
+
+  def click_jacking_protection?
+    !!click_jacking_protection
+  end
+
+  # return the found header value
+
+  def has_cookies
+    header_from("Set-Cookie")
+  end
+
+  def strict_transport_security
+    header_from("Strict-Transport-Security")
+  end
+
+  def content_security_policy
+    header_from("Content-Security-Policy")
+  end
+
+  def click_jacking_protection
+    header_from("X-Frame-Options")
+  end
+
   def server
-    response && response.headers["Server"]
+    header_from("Server")
   end
 
-  def xss_protection?
-    response && response.headers["X-XSS-Protection"] == "1; mode=block"
+  def xss_protection
+    header_from("X-XSS-Protection")
   end
 
-  def has_cookies?
-    response && response.headers.include?("Set-Cookie")
+  # more specific checks than presence of headers
+  def xss_protection?
+    xss_protection == "1; mode=block"
   end
 
   def secure_cookies?
     return nil if !response || !has_cookies?
-    cookie = response.headers["Set-Cookie"]
+    cookie = header_from("Set-Cookie")
     cookie = cookie.first if cookie.is_a?(Array)
     marked_secure = !!(cookie.downcase =~ /secure/)
-    marked_http_only = !!(cookie.downcase =~ /HttpOnly/)
+    marked_http_only = !!(cookie.downcase =~ /httponly/)
     marked_secure and marked_http_only
   end
 
-  def strict_transport_security?
-    response && response.headers.include?("Strict-Transport-Security")
-  end
+  # helper function: case-insensitive sweep for header, return value
+  def header_from(header)
+    return nil unless response
 
-  def content_security_policy?
-    response && response.headers.include?("Content-Security-Policy")
-  end
-
-  def click_jacking_protection?
-    response && response.headers.include?("X-Frame-Options")
+    the_header = response.headers.keys.find {|h| h.downcase =~ /^#{header.downcase}/}
+    response.headers[the_header]
   end
 end