Skip to content

README.md

Latest commit

 

History

History
135 lines (87 loc) · 7.71 KB

README.md

File metadata and controls

135 lines (87 loc) · 7.71 KB
Raw

OSHP Logo

OWASP Production

Introduction

📦 This repository contains all the content of the OWASP Secure Headers Project (also named OSHP).

OSHP Web URL

ℹ️ The url https://owasp.org/www-project-secure-headers redirect to the project page on the OWASP site.

OSHP ecosystem

🗺️ The OSHP project is composed of the following projects:

  • Main site: It is the core of the OSHP and provide the information about HTTP security headers.
    • Called mainsite.
    • Content is here.
      • It is the master data in markdown and is the content that is updated.
    • Web rendered content is here. It is based on the the master data in markdown and use the GitHub pages feature.
    • GitHub pages original URL is https://owasp.github.io/secure-headers-project/.
  • Validator: Venom tests suite to validate an HTTP security response headers configuration against OSHP recommendation.
    • Called validator.
    • Content is here.
  • Statistics: Statistics about HTTP response security headers usage mentioned by the OSHP.
    • Called statistics.
    • Content is here.

Repository structure

  • The base of the repository contains the main site.
  • The other projects are stored in the folder subprojects: Each sub projects have it own folder.
  • The project official logo is stored into the folder logo as well as into the OWASP Swag GitHub repository.
  • The folder ci (CI for Continuous Integration) contains materials to generate or update content using GitHub actions workflows.

GitHub actions

📝 The naming convention used is [project_call_name]_[action]_[target].yml where:

  • [project_call_name] is the project call name defined above.
  • [action] can be (validate|monitor|generate).

🔋 Health status:

Status File
mainsite_generate_headers-json-files.yml 📄
mainsite_generate_stats-related-files.yml 📄
mainsite_generate_technical-references-dashboard.yml 📄
mainsite_monitor_oshp-site-references.yml 📄
mainsite_monitor_oshp-gha-workflows.yml 📄
mainsite_validate_external-links.yml 📄
mainsite_validate_owasp-nest-metadata.yaml 📄
statistics_generate_datasource.yml 📄
validator_validate_tests-suite.yml 📄

Issue and discussions

💬 Both are handled using the following GitHub features:

Content editor

👩‍💻 Content editing is done with Visual Studio Code.

📦 A workspace file is provided with recommended extensions.

Social media communication

📩 This template is used to announce news on social media about OSHP update:

📡 OWASP Secure Headers Project: [MESSAGE].

#appsec #appsecurity #owasp_shp

[PRINT_SCREEN_IN_PNG_FORMAT_WHEN_APPLICABLE]

📖 [LINK_TO_OSHP_SECTION]

💡 Source used:

[LINK_TO_SOURCE_USED]

Project leaders

🧑‍💻 Ricardo Iramar

🧑‍💻 Dominique Righetto

Contributors

💌 Contributors to OSHP, before the migration of the project to GitHub:

💌 Visit this page for updated information about the contributors since the migration of the project to GitHub.

Licensing

📑 This project content is free to use. It is licensed under the Apache 2.0 License.

Usage of GenIA

Caution

📍 The content is created by a human, and GenIA is used as an assistant.

Rules

🧑‍💻 We limit the usage of GenIA models to the following cases:

  • Correcting spelling and grammar errors in English.
  • Technical assistance with script development or proof-of-concepts (POCs).
  • Brainstorming to generate ideas for the OSHP project.
  • Searching for technical documentation.
  • Validating our understanding of the technical aspects of a header.

⛔ GenIA must never author or directly draft the technical description, security rationale, or recommended configuration text for a header that gets published on the site:

  • A human must write and vouch for that content.
  • GenIA may only help research or validate it.

Help commands

  • The claude code command validate-md-content was created to help validating the content of a markdown file against predefined rules.
    • Usage from a claude session is /validate-md-content [markdown-file-to-validate].