netray.info

warn · TLS·26

The server accepts a broken cipher suite (RC4, 3DES, DES, export, NULL or anonymous), or a CBC suite or a static RSA key exchange without forward secrecy.

Fix: Allow only ECDHE suites with AES-GCM or ChaCha20-Poly1305 for TLS 1.2, and remove RC4, 3DES, DES, export, NULL, anonymous, CBC and static RSA suites.

TLS · RFC 9325guide →

warn · TLS·33

The domain's HTTPS record advertises no Encrypted Client Hello configuration.

Fix: Publish the server's ECH configuration in the ech= parameter of the HTTPS record, once Encrypted Client Hello is enabled on the server.

TLS · draft-ietf-tls-esniguide →

warn · HTTP·36

The site echoes an untrusted request Origin in Access-Control-Allow-Origin, or answers with Access-Control-Allow-Origin: null, together with Access-Control-Allow-Credentials: true, or allows any origin with Access-Control-Allow-Origin: *.

Fix: Allow only an explicit list of trusted origins and send Access-Control-Allow-Credentials only for those.

HTTP · WHATWG Fetch Standardguide →

warn · HTTP·38

Responses carry no enforced Content-Security-Policy, or one without default-src or with permissive sources such as 'unsafe-inline'.

Fix: Send an enforced Content-Security-Policy with default-src, object-src 'none' and base-uri that restricts scripts to trusted origins.

HTTP · W3C Content Security Policy Level 3guide →