checker-http/README.md

67 lines
3.6 KiB
Markdown

# checker-http
HTTP/HTTPS server checker plugin for [happyDomain](https://happydomain.org).
Probes the `abstract.Server` it is attached to over HTTP (port 80) and HTTPS
(port 443) and evaluates a battery of independent rules on the response.
Deep TLS / certificate analysis is intentionally **delegated to
[checker-tls](https://git.happydns.org/checker-tls)** - this checker only
relies on TLS for transport.
## What it checks
| Rule | What it verifies |
| --------------------------------- | --------------------------------------------------------------------------------- |
| `http.tcp_reachable` | Port 80 accepts connections on every A/AAAA address. |
| `https.tcp_reachable` | Port 443 accepts connections on every A/AAAA address. |
| `http.https_redirect` | Plain HTTP redirects to HTTPS (warning if not). |
| `http.hsts` | `Strict-Transport-Security` is present with a sufficient `max-age`. |
| `http.csp` | `Content-Security-Policy` is set; flags `'unsafe-inline'` / `'unsafe-eval'`. |
| `http.x_frame_options` | `X-Frame-Options` or CSP `frame-ancestors` provides clickjacking protection. |
| `http.x_content_type_options` | `X-Content-Type-Options: nosniff` is set. |
| `http.x_xss_protection` | Reports the legacy `X-XSS-Protection` header (recommendation: disable). |
| `http.cookie_flags` | Every Set-Cookie has `Secure`, `HttpOnly`, and a `SameSite` attribute. |
| `http.sri` | Cross-origin `<script>`/`<link>` tags carry `integrity=` (Subresource Integrity). |
## Options
User-configurable:
- `probeTimeoutMs`: per-request timeout (default: 10000)
- `maxRedirects`: redirect hops to follow (default: 5)
- `userAgent`: User-Agent header to send (default: `happyDomain-checker-http/1.0`)
- `requireHTTPS`: flag plain HTTP that does not redirect (default: true)
- `requireHSTS`: require Strict-Transport-Security on HTTPS (default: true)
- `minHSTSMaxAgeDays`: minimum acceptable HSTS max-age in days (default: 180)
- `requireCSP`: require Content-Security-Policy on HTTPS (default: false)
## Deployment
The `/collect` endpoint has no built-in authentication and will issue HTTP
requests to whatever IP addresses the target `abstract.Server` advertises
(including those discovered via the system resolver for additional A/AAAA
records). Because those addresses are user-controlled, a domain pointing at
`127.0.0.1`, an RFC1918 range, or a cloud metadata endpoint
(`169.254.169.254`) will cause the checker to fetch internal resources and
return their headers, cookies, and HTML body in the observation payload,
a classic SSRF surface.
It is meant to run on a trusted network, reachable only by the happyDomain
instance that drives it, and from a network position that cannot reach
internal services or metadata endpoints. Restrict access via a reverse
proxy with authentication, a network ACL, or by binding the listener to a
private interface; do not expose it directly to the public internet, and
prefer running it from an egress-restricted network segment.
## Build
```sh
make # standalone binary: ./checker-http
make plugin # Go plugin .so: ./checker-http.so
make docker # Docker image: happydomain/checker-http
```
## License
AGPL-3.0 (see [LICENSE](LICENSE) and [NOTICE](NOTICE)).