id: expect-ct-misconfigured

info:
  name: Expect-CT Header - Misconfigured
  author: theamanrawat
  severity: info
  description: |
    Detected misconfigured Expect-CT headers: max-age is 0 (ineffective) and enforce directive is missing
  reference:
    - https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Expect-CT
    - https://scotthelme.co.uk/a-new-security-header-expect-ct/
  tags: headers,expect-ct,misconfiguration

http:
  - method: GET
    path:
      - "{{BaseURL}}"

    matchers:
      - type: dsl
        dsl:
          - 'contains(tolower(header), "expect-ct")'
          - 'contains(tolower(header), "max-age=0") || !contains(tolower(header), "enforce")'
        condition: and

    extractors:
      - type: kval
        part: header
        kval:
          - expect_ct
# digest: 490a00463044021f6900168d8b0723c145394e9ca67d777de84e4470e70b0a6bccc37519221c32022100dc03aec371984d35619aa6a412ac36674871dc82a1d6856766a47c79abd66363:922c64590222798bb761d5b6d8e72950