Metadata-Version: 2.4
Name: klyrek-headers
Version: 0.1.0
Summary: HTTP security header analysis for the Klyrek ecosystem
Author: Klyrek Contributors
License: MIT
Keywords: appsec,http-headers,pentesting,reconnaissance,security
Classifier: Development Status :: 3 - Alpha
Classifier: Intended Audience :: Information Technology
Classifier: License :: OSI Approved :: MIT License
Classifier: Programming Language :: Python :: 3
Classifier: Topic :: Security
Requires-Python: >=3.10
Requires-Dist: httpx>=0.27
Requires-Dist: klyrek-core
Provides-Extra: dev
Requires-Dist: mypy>=1.10; extra == 'dev'
Requires-Dist: pytest>=8.0; extra == 'dev'
Requires-Dist: ruff>=0.6; extra == 'dev'
Description-Content-Type: text/markdown

# klyrek-headers

HTTP security header analysis. Takes a single `httpx.Response` (as returned by
`klyrek-http`/`klyrek-crawler`) and produces `klyrek_core.models.Finding` objects for missing or
misconfigured security controls: HSTS, CSP, clickjacking protection, cookie flags
(`Secure`/`HttpOnly`/`SameSite`), CORS misconfiguration, and information-disclosure headers
(`Server`, `X-Powered-By`).

This is the first Klyrek module whose output is a `Finding` rather than just an `Endpoint` —
everything upstream (`klyrek-crawler`) maps the application; this is where the tool starts
telling you something is actually wrong.

```python
from klyrek_headers.analyzer import analyze

response = client.get("https://target.com/")
findings = analyze(response)

for finding in findings:
    print(finding.severity, finding.title)
```

Findings are informational hints for a human reviewer to confirm, not proof of exploitability —
e.g. a missing `X-Frame-Options` header is flagged even though modern CSP `frame-ancestors` may
cover it, and a wildcard CORS origin is flagged even when browsers would reject the exact
combination sent, because both patterns indicate configuration worth a second look.
