HSTS Preload Auditor
Pricing
Pay per usage
Audit a public HTTPS URL's HSTS header against hstspreload.org submission requirements. Returns max-age, includeSubDomains, preload eligibility, redirect verification, score, grade, and recommendations.
Pricing
Pay per usage
Rating
0.0
(0)
Developer
Sanskar Jaiswal
Maintained by CommunityActor stats
0
Bookmarked
2
Total users
1
Monthly active users
5 days ago
Last modified
Categories
Share
FROM apify/actor-node:22
WORKDIR /usr/src/appCOPY package*.json ./RUN npm install --omit=devCOPY . ./CMD ["npm", "start"]{ "name": "hsts-preload-auditor", "version": "0.1.0", "description": "Apify Actor that fetches one public HTTPS URL and audits its Strict-Transport-Security header against the hstspreload.org submission requirements. Parses the header per RFC 6797, verifies the HTTP-to-HTTPS redirect, optionally checks the www subdomain, and returns a preload readiness score, letter grade, issues, and recommendations.", "type": "module", "private": true, "main": "src/main.js", "scripts": { "start": "node src/main.js", "test": "node --test test/*.test.js", "lint": "node --check src/main.js" }, "dependencies": { "apify": "^3.4.5" }, "devDependencies": {}}{ "actorSpecification": 1, "name": "hsts-preload-auditor", "title": "HSTS Preload Auditor", "description": "Fetch one public URL and audit its Strict-Transport-Security header against hstspreload.org submission requirements. Parses the header per RFC 6797, verifies the HTTP-to-HTTPS redirect, optionally checks the www subdomain, and returns a preload readiness score, grade, issues, and recommendations.", "version": "0.1", "buildTag": "latest", "meta": { "templateId": "js-start" }, "input": "./input_schema.json", "output": "./output_schema.json", "storages": { "dataset": "./dataset_schema.json" }, "dockerfile": "./Dockerfile", "defaultRunOptions": { "build": "latest", "timeoutSecs": 120, "memoryMbytes": 512 }}{ "actorSpecification": 1, "views": { "overview": { "title": "HSTS preload audits", "transformation": { "fields": [ "inputUrl", "finalUrl", "ok", "hasHsts", "maxAge", "includeSubDomains", "preloadDirective", "httpRedirectOk", "preloadEligible", "classification", "score", "grade", "checkedAt", "error" ] }, "display": { "component": "table", "properties": { "inputUrl": { "label": "Input URL", "format": "link" }, "finalUrl": { "label": "Final URL", "format": "link" }, "ok": { "label": "OK", "format": "boolean" }, "hasHsts": { "label": "HSTS", "format": "boolean" }, "maxAge": { "label": "max-age (s)" }, "includeSubDomains": { "label": "includeSubDomains", "format": "boolean" }, "preloadDirective": { "label": "preload", "format": "boolean" }, "httpRedirectOk": { "label": "HTTP redirect", "format": "boolean" }, "preloadEligible": { "label": "Preload eligible", "format": "boolean" }, "classification": { "label": "Classification" }, "score": { "label": "Score" }, "grade": { "label": "Grade" }, "checkedAt": { "label": "Checked at", "format": "date" }, "error": { "label": "Error" } } } } }, "fields": { "inputUrl": { "type": "string", "title": "Input URL" }, "normalizedInputUrl": { "type": "string", "title": "Normalized input URL" }, "finalUrl": { "type": "string", "title": "Final URL" }, "https": { "type": "boolean", "title": "HTTPS" }, "ok": { "type": "boolean", "title": "OK" }, "checkedAt": { "type": "string", "title": "Checked at", "format": "date-time" }, "httpStatus": { "type": ["integer", "null"], "title": "HTTP status" }, "hasHsts": { "type": "boolean", "title": "Strict-Transport-Security header present" }, "rawHsts": { "type": ["string", "null"], "title": "Raw HSTS header value" }, "maxAge": { "type": ["integer", "null"], "title": "max-age seconds" }, "maxAgeMeetsPreload": { "type": "boolean", "title": "max-age meets preload requirement" }, "includeSubDomains": { "type": "boolean", "title": "includeSubDomains directive present" }, "preloadDirective": { "type": "boolean", "title": "preload directive present" }, "hasExtraDirectives": { "type": "boolean", "title": "Has unrecognized directives" }, "extraDirectives": { "type": "array", "title": "Unrecognized directive names" }, "multipleMaxAge": { "type": "boolean", "title": "Multiple max-age directives" }, "classification": { "type": "string", "title": "Header classification" }, "validCertificate": { "type": "boolean", "title": "HTTPS reachable with valid certificate" }, "httpRedirectChecked": { "type": "boolean", "title": "HTTP redirect check performed" }, "httpRedirectOk": { "type": ["boolean", "null"], "title": "HTTP redirects to HTTPS" }, "httpRedirectStatus": { "type": ["integer", "null"], "title": "Final HTTP status of redirect check" }, "httpRedirectTarget": { "type": ["string", "null"], "title": "Redirect target URL" }, "wwwSubdomainChecked": { "type": "boolean", "title": "www subdomain check performed" }, "wwwSubdomainOk": { "type": ["boolean", "null"], "title": "www subdomain serves HTTPS" }, "wwwSubdomainStatus": { "type": ["integer", "null"], "title": "www subdomain HTTP status" }, "preloadEligible": { "type": "boolean", "title": "Preload eligible" }, "submissionReady": { "type": "boolean", "title": "Submission ready" }, "score": { "type": "integer", "title": "Score" }, "grade": { "type": "string", "title": "Grade" }, "issues": { "type": "array", "title": "Issues" }, "recommendations": { "type": "array", "title": "Recommendations" }, "error": { "type": ["string", "null"], "title": "Error" } }}{ "title": "HSTS Preload Auditor input", "description": "Fetch one public HTTPS URL and audit its Strict-Transport-Security header against the hstspreload.org submission requirements. The actor parses the header per RFC 6797 (max-age, includeSubDomains, preload, unknown directives), verifies the HTTP-to-HTTPS redirect on the same host, optionally checks the www subdomain, and returns a preload readiness score, letter grade, issues, and recommendations. URLs with credentials and private network targets are rejected.", "type": "object", "schemaVersion": 1, "properties": { "startUrl": { "title": "URL", "type": "string", "description": "Public HTTPS URL to audit. The actor fetches this page and inspects the Strict-Transport-Security response header.", "editor": "textfield", "prefill": "https://example.com/" }, "timeoutSeconds": { "title": "Timeout seconds", "type": "integer", "description": "Request timeout from 3 to 30 seconds per request.", "editor": "number", "default": 10, "minimum": 3, "maximum": 30 }, "checkHttpRedirect": { "title": "Check HTTP to HTTPS redirect", "type": "boolean", "description": "Also request the plain-HTTP version of the host and verify it redirects to HTTPS on the same host, as required for preload submission.", "editor": "checkbox", "default": true }, "checkWwwSubdomain": { "title": "Check www subdomain over HTTPS", "type": "boolean", "description": "Also request the www subdomain (or the bare domain if the input is www) over HTTPS and verify it responds successfully, since preloading covers all subdomains.", "editor": "checkbox", "default": false } }, "required": ["startUrl"]}{ "actorOutputSchemaVersion": 1, "title": "HSTS Preload Audit Results", "properties": { "results": { "type": "string", "title": "Results", "template": "{{links.apiDefaultDatasetUrl}}/items" } }}1import { Actor } from 'apify';2import dns from 'node:dns/promises';3import net from 'node:net';4import { fileURLToPath } from 'node:url';5
6const USER_AGENT = 'HstsPreloadAuditor/0.1 (+https://apify.com)';7const DEFAULT_TIMEOUT_SECONDS = 10;8
9/* ---------------------------------------------------------------------------10 * SSRF protection — shared pattern used across URL-fetching factory actors.11 * Allows only HTTP/HTTPS, rejects URL credentials, rejects localhost/private12 * IP literals, DNS-resolves hostnames, and rejects DNS that resolves to13 * private IP ranges.14 * ------------------------------------------------------------------------- */15
16function isPrivateIPv4(ip) {17 const parts = ip.split('.').map(Number);18 if (parts.length !== 4 || parts.some((n) => Number.isNaN(n))) return false;19 const [a, b] = parts;20 return a === 1021 || (a === 172 && b >= 16 && b <= 31)22 || (a === 192 && b === 168)23 || a === 12724 || a === 025 || (a === 169 && b === 254);26}27
28function isPrivateIPv6(ip) {29 const normalized = ip.toLowerCase();30 return normalized === '::1'31 || normalized.startsWith('fc')32 || normalized.startsWith('fd')33 || normalized.startsWith('fe80:');34}35
36export async function normalizeAndValidateUrl(rawUrl) {37 if (!rawUrl || typeof rawUrl !== 'string') throw new Error('URL is required');38 if (/^[a-z][a-z0-9+.-]*:/i.test(rawUrl) && !/^https?:\/\//i.test(rawUrl)) {39 throw new Error('Only HTTP and HTTPS URLs are supported');40 }41 const withScheme = /^https?:\/\//i.test(rawUrl) ? rawUrl : `https://${rawUrl}`;42 const url = new URL(withScheme);43 if (!['http:', 'https:'].includes(url.protocol)) throw new Error('Only HTTP and HTTPS URLs are supported');44 if (!url.hostname || url.username || url.password) throw new Error('URL must be public and must not include credentials');45
46 // Node's URL keeps brackets on IPv6 literals ([::1]); strip for IP checks.47 const hostLiteral = url.hostname.startsWith('[') && url.hostname.endsWith(']')48 ? url.hostname.slice(1, -1)49 : url.hostname;50
51 const literalType = net.isIP(hostLiteral);52 if (literalType === 4 && isPrivateIPv4(hostLiteral)) throw new Error('Private IPv4 targets are blocked');53 if (literalType === 6 && isPrivateIPv6(hostLiteral)) throw new Error('Private IPv6 targets are blocked');54
55 const records = literalType ? [{ address: hostLiteral, family: literalType }] : await dns.lookup(url.hostname, { all: true });56 for (const record of records) {57 if (record.family === 4 && isPrivateIPv4(record.address)) throw new Error('DNS resolves to a private IPv4 address; blocked for SSRF safety');58 if (record.family === 6 && isPrivateIPv6(record.address)) throw new Error('DNS resolves to a private IPv6 address; blocked for SSRF safety');59 }60 return url;61}62
63/* ---------------------------------------------------------------------------64 * HTTP fetch with manual redirect revalidation (SSRF-safe).65 * Each redirect target is revalidated through normalizeAndValidateUrl before66 * being followed. Returns status, headers, and final URL chain info.67 * ------------------------------------------------------------------------- */68
69async function fetchUrl(initialUrl, timeoutSeconds, redirectsRemaining = 3) {70 await normalizeAndValidateUrl(initialUrl.href);71 const controller = new AbortController();72 const timeout = setTimeout(() => controller.abort(), timeoutSeconds * 1000);73 try {74 const response = await fetch(initialUrl, {75 redirect: 'manual',76 signal: controller.signal,77 headers: { 'user-agent': USER_AGENT, accept: 'text/html,application/xhtml+xml,*/*;q=0.1' },78 });79
80 if ([301, 302, 303, 307, 308].includes(response.status)) {81 if (redirectsRemaining <= 0) throw new Error('Too many redirects');82 const location = response.headers.get('location');83 if (!location) throw new Error('Redirect without Location header');84 const nextUrl = new URL(location, initialUrl.href);85 try { await response.arrayBuffer(); } catch { /* drain */ }86 return fetchUrl(nextUrl, timeoutSeconds, redirectsRemaining - 1);87 }88
89 try { await response.arrayBuffer(); } catch { /* drain */ }90 return {91 ok: response.ok,92 status: response.status,93 finalUrl: response.url || initialUrl.href,94 https: (response.url || initialUrl.href).startsWith('https://'),95 headers: response.headers,96 error: null,97 };98 } catch (error) {99 return {100 ok: false,101 status: null,102 finalUrl: initialUrl.href,103 https: initialUrl.protocol === 'https:',104 headers: null,105 error: error.message,106 };107 } finally {108 clearTimeout(timeout);109 }110}111
112/* ---------------------------------------------------------------------------113 * HSTS header parsing per RFC 6797.114 * Grammar: "Strict-Transport-Security" ":" [ directive ] *( ";" [ directive ] )115 * directive = max-age=N | includeSubDomains | preload116 * Unknown directives are ignored per RFC 6797 section 6.1 (MUST ignore117 * unrecognized directives). Multiple comma-separated header values are118 * combined; hstspreload.org itself accepts them as equivalent to a single119 * header with the union of directives.120 * ------------------------------------------------------------------------- */121
122const PRELOAD_MAX_AGE_REQUIRED = 31536000; // 1 year in seconds, per hstspreload.org123
124export function parseHstsHeader(rawValue) {125 const result = {126 raw: rawValue || null,127 maxAge: null,128 maxAgeRaw: null,129 includeSubDomains: false,130 preload: false,131 unknownDirectives: [],132 hasMaxAge: false,133 hasInvalidMaxAge: false,134 multipleMaxAge: false,135 hasExtraDirectives: false,136 extraDirectives: [],137 valid: false,138 };139 if (!rawValue || typeof rawValue !== 'string' || rawValue.trim() === '') return result;140
141 const known = new Set(['max-age', 'includesubdomains', 'preload']);142 let maxAgeCount = 0;143 const extra = new Set();144
145 // Multiple Strict-Transport-Security header lines get comma-joined by146 // undici; treat the whole value as one directive stream.147 for (const part of rawValue.split(',')) {148 for (const token of part.split(';')) {149 const trimmed = token.trim();150 if (trimmed === '') continue;151 const eq = trimmed.indexOf('=');152 const name = (eq === -1 ? trimmed : trimmed.slice(0, eq)).trim().toLowerCase();153 const value = eq === -1 ? null : trimmed.slice(eq + 1).trim();154
155 if (name === 'max-age') {156 maxAgeCount += 1;157 result.maxAgeRaw = value;158 if (value !== null && /^\d+$/.test(value)) {159 result.maxAge = Number(value);160 result.hasMaxAge = true;161 } else {162 result.hasInvalidMaxAge = true;163 }164 } else if (name === 'includesubdomains') {165 result.includeSubDomains = true;166 } else if (name === 'preload') {167 result.preload = true;168 } else {169 // value-bearing unknown token, e.g. report-uri or a typo170 result.unknownDirectives.push(trimmed);171 extra.add(name);172 }173 }174 }175
176 if (maxAgeCount > 1) result.multipleMaxAge = true;177 if (extra.size > 0) {178 result.hasExtraDirectives = true;179 result.extraDirectives = [...extra];180 }181 result.valid = result.hasMaxAge && !result.hasInvalidMaxAge;182 return result;183}184
185/* ---------------------------------------------------------------------------186 * Classify a parsed HSTS header against hstspreload.org submission criteria:187 * 1. max-age >= 31536000188 * 2. includeSubDomains189 * 3. preload directive190 * (Certificate, HTTP->HTTPS redirect, and subdomain coverage are verified191 * by separate network checks in the main pipeline.)192 * ------------------------------------------------------------------------- */193
194export function classifyHsts(parsed) {195 if (parsed.hasInvalidMaxAge) return 'invalid';196 if (!parsed.hasMaxAge) return 'missing';197 if (parsed.maxAge < PRELOAD_MAX_AGE_REQUIRED) return 'short-max-age';198 if (!parsed.includeSubDomains) return 'missing-include-subdomains';199 if (!parsed.preload) return 'missing-preload';200 return 'preload-eligible';201}202
203/* ---------------------------------------------------------------------------204 * Score and grade the HSTS preload readiness posture.205 * The score is oriented toward preload readiness, not just HSTS presence:206 * a plain HSTS header without preload intent caps at 70.207 * ------------------------------------------------------------------------- */208
209export function scoreHsts(analysis) {210 const issues = [];211 const recommendations = [];212 const { hasHsts, parsed, classification, httpsRedirectOk, validCertificate } = analysis;213
214 if (!hasHsts) {215 issues.push('No Strict-Transport-Security header was served on the HTTPS response. Browsers will still permit plain-HTTP connections to this host.');216 recommendations.push('Configure the web server to send Strict-Transport-Security: max-age=31536000; includeSubDomains; preload on all HTTPS responses.');217 return finalize(20, issues, recommendations);218 }219
220 let score = 70; // valid baseline HSTS221
222 if (classification === 'invalid') {223 score -= 30;224 issues.push(`The max-age directive value "${parsed.maxAgeRaw}" is not a valid non-negative integer. Browsers ignore the entire header.`);225 recommendations.push('Set max-age to a plain number of seconds, e.g. max-age=31536000.');226 } else {227 if (!parsed.includeSubDomains) {228 score -= 15;229 issues.push('The includeSubDomains directive is missing. Subdomains are not covered by the HSTS policy and the domain cannot be preloaded.');230 recommendations.push('Add the includeSubDomains directive. Confirm every subdomain serves valid HTTPS before doing so.');231 }232 if (!parsed.preload) {233 score -= 10;234 issues.push('The preload directive is missing. hstspreload.org will reject a submission without it.');235 recommendations.push('Add the preload directive once all subdomains serve valid HTTPS over valid certificates.');236 }237 if (parsed.hasMaxAge && parsed.maxAge < PRELOAD_MAX_AGE_REQUIRED) {238 score -= 15;239 issues.push(`max-age is ${parsed.maxAge} seconds, below the ${PRELOAD_MAX_AGE_REQUIRED} seconds (1 year) required for preload submission.`);240 recommendations.push(`Raise max-age to at least ${PRELOAD_MAX_AGE_REQUIRED}.`);241 }242 if (parsed.multipleMaxAge) {243 score -= 5;244 issues.push('Multiple max-age directives were detected in the header. This is malformed and the header may be ignored.');245 recommendations.push('Send a single max-age directive.');246 }247 if (parsed.hasExtraDirectives) {248 issues.push(`Unrecognized directive(s) present: ${parsed.extraDirectives.join(', ')}. RFC 6797 requires browsers to ignore them, but hstspreload.org submission requires a clean header.`);249 recommendations.push('Remove any directives other than max-age, includeSubDomains, and preload.');250 }251 }252
253 if (classification === 'preload-eligible' && httpsRedirectOk !== false && validCertificate !== false) {254 score = 100; // every performed check passed255 }256
257 if (httpsRedirectOk === false) {258 score -= 15;259 issues.push('The plain-HTTP (port 80) request did not redirect to HTTPS on the same host. Preload submission requires an HTTP-to-HTTPS redirect.');260 recommendations.push('Configure the HTTP (port 80) virtual host to redirect to the HTTPS URL on the same host.');261 }262
263 if (validCertificate === false) {264 score -= 15;265 issues.push('The HTTPS request failed certificate validation or did not complete. Preload submission requires a valid certificate chain.');266 recommendations.push('Fix the TLS certificate chain (valid, non-expired, matching the hostname) and retry.');267 }268
269 return finalize(score, issues, recommendations);270}271
272function finalize(score, issues, recommendations) {273 const bounded = Math.max(0, Math.min(100, score));274 const grade = bounded >= 95 ? 'A+'275 : bounded >= 85 ? 'A'276 : bounded >= 75 ? 'B'277 : bounded >= 65 ? 'C'278 : bounded >= 50 ? 'D'279 : bounded >= 30 ? 'E'280 : 'F';281
282 if (bounded >= 95 && issues.length === 0) {283 recommendations.push('HSTS preload requirements are met. Submit the domain at hstspreload.org, then monitor that the header never regresses after deploys.');284 }285
286 if (recommendations.length === 0 && issues.length === 0) {287 recommendations.push('No HSTS issues detected.');288 }289
290 return { score: bounded, grade, issues, recommendations };291}292
293/* ---------------------------------------------------------------------------294 * Main audit pipeline.295 * 1. HTTPS fetch of the URL -> strict-transport-security header.296 * 2. If the input was HTTPS and the host has port 80 reachable, an297 * additional plain-HTTP fetch checks for the same-host HTTPS redirect.298 * ------------------------------------------------------------------------- */299
300export async function auditHstsPreload(input) {301 const timeoutSeconds = Math.min(Math.max(Number(input.timeoutSeconds || DEFAULT_TIMEOUT_SECONDS), 3), 30);302 const checkHttpRedirect = input.checkHttpRedirect !== false;303 const checkWwwSubdomain = input.checkWwwSubdomain === true;304
305 let startUrl;306 try {307 startUrl = await normalizeAndValidateUrl(input.startUrl);308 } catch (validationError) {309 return errorResult(input.startUrl, validationError.message);310 }311
312 // 1. HTTPS fetch (audit the canonical HTTPS response of the host)313 let fetched;314 try {315 fetched = await fetchUrl(startUrl, timeoutSeconds);316 } catch (fetchError) {317 return errorResult(input.startUrl, fetchError.message);318 }319
320 if (fetched.error) {321 return errorResult(input.startUrl, fetched.error, fetched.finalUrl, fetched.https, fetched.status);322 }323
324 const rawHsts = fetched.headers ? fetched.headers.get('strict-transport-security') : null;325 const hasHsts = rawHsts !== null && rawHsts.trim() !== '';326 const parsed = hasHsts ? parseHstsHeader(rawHsts) : parseHstsHeader(null);327 const classification = hasHsts ? classifyHsts(parsed) : 'missing';328
329 // 2. HTTP -> HTTPS redirect check (only for https:// input URLs)330 let httpsRedirectOk = null;331 let httpRedirectStatus = null;332 let httpRedirectTarget = null;333 if (checkHttpRedirect && startUrl.protocol === 'https:') {334 const httpUrl = new URL(startUrl.href);335 httpUrl.protocol = 'http:';336 const httpResult = await fetchUrl(httpUrl, timeoutSeconds);337 if (httpResult.error) {338 httpsRedirectOk = false;339 httpRedirectStatus = null;340 httpRedirectTarget = null;341 } else if (httpResult.https) {342 httpsRedirectOk = true;343 httpRedirectStatus = httpResult.status;344 httpRedirectTarget = httpResult.finalUrl;345 } else {346 httpsRedirectOk = false;347 httpRedirectStatus = httpResult.status;348 httpRedirectTarget = httpResult.finalUrl;349 }350 }351
352 // 3. Optional www subdomain HTTPS check (preload applies to all subdomains)353 let wwwSubdomainOk = null;354 let wwwSubdomainStatus = null;355 if (checkWwwSubdomain && startUrl.hostname.split('.').length > 2) {356 const parts = startUrl.hostname.split('.');357 if (parts[0] === 'www') {358 // input is already www; check the bare domain instead359 const bareHost = parts.slice(1).join('.');360 try {361 const bareUrl = new URL(`https://${bareHost}/`);362 const bareResult = await fetchUrl(bareUrl, timeoutSeconds);363 wwwSubdomainOk = !bareResult.error && bareResult.ok;364 wwwSubdomainStatus = bareResult.status;365 } catch {366 wwwSubdomainOk = false;367 }368 } else {369 try {370 const wwwUrl = new URL(`https://www.${startUrl.hostname}/`);371 const wwwResult = await fetchUrl(wwwUrl, timeoutSeconds);372 wwwSubdomainOk = !wwwResult.error && wwwResult.ok;373 wwwSubdomainStatus = wwwResult.status;374 } catch {375 wwwSubdomainOk = false;376 }377 }378 }379
380 // A successful HTTPS fetch of the start URL is taken as certificate381 // validation success, because Node fetch rejects invalid certificate382 // chains by default (fetch fails with UND_ERR or CERT errors).383 const validCertificate = fetched.https && fetched.ok;384
385 const analysis = {386 hasHsts,387 parsed,388 classification,389 httpsRedirectOk,390 validCertificate,391 };392
393 const scored = scoreHsts(analysis);394
395 // Preload eligibility across the verifiable checks396 const headerEligible = classification === 'preload-eligible';397 const redirectEligible = httpsRedirectOk !== false;398 const certEligible = validCertificate !== false;399 const wwwEligible = wwwSubdomainOk !== false;400 const preloadEligible = headerEligible && redirectEligible && certEligible && wwwEligible;401
402 return {403 inputUrl: input.startUrl,404 normalizedInputUrl: startUrl.href,405 finalUrl: fetched.finalUrl,406 https: fetched.https,407 ok: true,408 checkedAt: new Date().toISOString(),409 httpStatus: fetched.status,410 hasHsts,411 rawHsts,412 maxAge: parsed.maxAge,413 maxAgeMeetsPreload: parsed.hasMaxAge && parsed.maxAge >= PRELOAD_MAX_AGE_REQUIRED,414 includeSubDomains: parsed.includeSubDomains,415 preloadDirective: parsed.preload,416 hasExtraDirectives: parsed.hasExtraDirectives,417 extraDirectives: parsed.extraDirectives,418 multipleMaxAge: parsed.multipleMaxAge,419 classification,420 validCertificate,421 httpRedirectChecked: httpsRedirectOk !== null,422 httpRedirectOk: httpsRedirectOk,423 httpRedirectStatus,424 httpRedirectTarget,425 wwwSubdomainChecked: wwwSubdomainOk !== null,426 wwwSubdomainOk,427 wwwSubdomainStatus,428 preloadEligible,429 submissionReady: preloadEligible,430 score: scored.score,431 grade: scored.grade,432 issues: scored.issues,433 recommendations: scored.recommendations,434 error: null,435 };436}437
438function errorResult(inputUrl, errorMsg, finalUrl, https, httpStatus) {439 return {440 inputUrl,441 normalizedInputUrl: null,442 finalUrl: finalUrl || (typeof inputUrl === 'string' ? inputUrl : null),443 https: https ?? false,444 ok: false,445 checkedAt: new Date().toISOString(),446 httpStatus: httpStatus ?? null,447 hasHsts: false,448 rawHsts: null,449 maxAge: null,450 maxAgeMeetsPreload: false,451 includeSubDomains: false,452 preloadDirective: false,453 hasExtraDirectives: false,454 extraDirectives: [],455 multipleMaxAge: false,456 classification: 'missing',457 validCertificate: false,458 httpRedirectChecked: false,459 httpRedirectOk: null,460 httpRedirectStatus: null,461 httpRedirectTarget: null,462 wwwSubdomainChecked: false,463 wwwSubdomainOk: null,464 wwwSubdomainStatus: null,465 preloadEligible: false,466 submissionReady: false,467 score: 0,468 grade: 'F',469 issues: ['The request failed before the HSTS header could be inspected. Verify the URL is reachable over HTTPS and try again.'],470 recommendations: ['Verify the URL is public, reachable over HTTPS with a valid certificate, and returns a response.'],471 error: errorMsg,472 };473}474
475/* ---------------------------------------------------------------------------476 * Apify runtime entry point.477 * ------------------------------------------------------------------------- */478
479const isExecutedDirectly = process.argv[1] && fileURLToPath(import.meta.url) === process.argv[1];480
481if (process.env.NODE_ENV !== 'test' && isExecutedDirectly) {482 await Actor.init();483 try {484 const input = await Actor.getInput();485 const result = await auditHstsPreload(input || {});486 await Actor.pushData(result);487 await Actor.setValue('OUTPUT', result);488 Actor.log.info('HSTS preload audit complete', {489 hasHsts: result.hasHsts,490 classification: result.classification,491 preloadEligible: result.preloadEligible,492 score: result.score,493 grade: result.grade,494 });495 } finally {496 await Actor.exit();497 }498}1import test from 'node:test';2import assert from 'node:assert/strict';3import {4 parseHstsHeader,5 classifyHsts,6 scoreHsts,7 normalizeAndValidateUrl,8 auditHstsPreload,9} from '../src/main.js';10
11/* --- parseHstsHeader: parsing ------------------------------------------ */12
13test('parseHstsHeader parses a full preload-eligible header', () => {14 const r = parseHstsHeader('max-age=31536000; includeSubDomains; preload');15 assert.equal(r.maxAge, 31536000);16 assert.equal(r.includeSubDomains, true);17 assert.equal(r.preload, true);18 assert.equal(r.valid, true);19 assert.equal(r.unknownDirectives.length, 0);20});21
22test('parseHstsHeader handles plain max-age only', () => {23 const r = parseHstsHeader('max-age=300');24 assert.equal(r.maxAge, 300);25 assert.equal(r.includeSubDomains, false);26 assert.equal(r.preload, false);27 assert.equal(r.valid, true);28});29
30test('parseHstsHeader handles empty and null input', () => {31 assert.equal(parseHstsHeader('').maxAge, null);32 assert.equal(parseHstsHeader(null).maxAge, null);33 assert.equal(parseHstsHeader(undefined).valid, false);34});35
36test('parseHstsHeader is case-insensitive on directive names', () => {37 const r = parseHstsHeader('Max-Age=31536000; IncludeSubDomains; Preload');38 assert.equal(r.maxAge, 31536000);39 assert.equal(r.includeSubDomains, true);40 assert.equal(r.preload, true);41});42
43test('parseHstsHeader tolerates whitespace around tokens', () => {44 const r = parseHstsHeader(' max-age = 31536000 ; includeSubDomains ; preload ');45 assert.equal(r.maxAge, 31536000);46 assert.equal(r.includeSubDomains, true);47 assert.equal(r.preload, true);48});49
50test('parseHstsHeader flags invalid max-age value', () => {51 const r = parseHstsHeader('max-age=abc; preload');52 assert.equal(r.hasMaxAge, false);53 assert.equal(r.hasInvalidMaxAge, true);54 assert.equal(r.maxAge, null);55 assert.equal(r.valid, false);56 // preload is still parsed even though the header is invalid overall57 assert.equal(r.preload, true);58});59
60test('parseHstsHeader flags negative max-age', () => {61 const r = parseHstsHeader('max-age=-1');62 assert.equal(r.hasInvalidMaxAge, true);63 assert.equal(r.valid, false);64});65
66test('parseHstsHeader collects unknown directives', () => {67 const r = parseHstsHeader('max-age=31536000; includeSubDomains; preload; report-uri="https://example.com/r"');68 assert.equal(r.hasExtraDirectives, true);69 assert.equal(r.extraDirectives.length, 1);70 assert.equal(r.extraDirectives[0], 'report-uri');71 assert.equal(r.unknownDirectives.length, 1);72});73
74test('parseHstsHeader detects multiple max-age directives', () => {75 const r = parseHstsHeader('max-age=100; max-age=31536000');76 assert.equal(r.multipleMaxAge, true);77});78
79test('parseHstsHeader merges comma-joined duplicate header lines', () => {80 // undici joins multiple header lines with ", "81 const r = parseHstsHeader('max-age=31536000, includeSubDomains, preload');82 assert.equal(r.maxAge, 31536000);83 assert.equal(r.includeSubDomains, true);84 assert.equal(r.preload, true);85});86
87test('parseHstsHeader handles whitespace-only header', () => {88 const r = parseHstsHeader(' ');89 assert.equal(r.hasMaxAge, false);90 assert.equal(r.valid, false);91});92
93/* --- classifyHsts: preload classification ------------------------------ */94
95test('classifyHsts returns preload-eligible for a compliant header', () => {96 const r = classifyHsts(parseHstsHeader('max-age=31536000; includeSubDomains; preload'));97 assert.equal(r, 'preload-eligible');98});99
100test('classifyHsts returns missing when no header', () => {101 assert.equal(classifyHsts(parseHstsHeader(null)), 'missing');102});103
104test('classifyHsts detects short max-age', () => {105 const r = classifyHsts(parseHstsHeader('max-age=1000; includeSubDomains; preload'));106 assert.equal(r, 'short-max-age');107});108
109test('classifyHsts detects missing includeSubDomains', () => {110 const r = classifyHsts(parseHstsHeader('max-age=31536000; preload'));111 assert.equal(r, 'missing-include-subdomains');112});113
114test('classifyHsts detects missing preload', () => {115 const r = classifyHsts(parseHstsHeader('max-age=31536000; includeSubDomains'));116 assert.equal(r, 'missing-preload');117});118
119test('classifyHsts detects invalid max-age', () => {120 const r = classifyHsts(parseHstsHeader('max-age=oops; includeSubDomains; preload'));121 assert.equal(r, 'invalid');122});123
124/* --- scoreHsts: scoring ------------------------------------------------- */125
126test('scoreHsts gives A+ for a fully eligible site with redirect and cert', () => {127 const scored = scoreHsts({128 hasHsts: true,129 parsed: parseHstsHeader('max-age=31536000; includeSubDomains; preload'),130 classification: 'preload-eligible',131 httpsRedirectOk: true,132 validCertificate: true,133 });134 assert.equal(scored.score, 100);135 assert.equal(scored.grade, 'A+');136 assert.equal(scored.issues.length, 0);137});138
139test('scoreHsts fails hard with no HSTS header', () => {140 const scored = scoreHsts({141 hasHsts: false,142 parsed: parseHstsHeader(null),143 classification: 'missing',144 httpsRedirectOk: true,145 validCertificate: true,146 });147 assert.equal(scored.score, 20);148 assert.equal(scored.grade, 'F');149 assert.ok(scored.issues.some((i) => i.includes('No Strict-Transport-Security')));150});151
152test('scoreHsts penalizes missing preload directive less than missing includeSubDomains', () => {153 const noPreload = scoreHsts({154 hasHsts: true,155 parsed: parseHstsHeader('max-age=31536000; includeSubDomains'),156 classification: 'missing-preload',157 httpsRedirectOk: true,158 validCertificate: true,159 });160 const noIsd = scoreHsts({161 hasHsts: true,162 parsed: parseHstsHeader('max-age=31536000; preload'),163 classification: 'missing-include-subdomains',164 httpsRedirectOk: true,165 validCertificate: true,166 });167 assert.ok(noPreload.score > noIsd.score);168 assert.equal(noPreload.score, 60);169 assert.equal(noIsd.score, 55);170});171
172test('scoreHsts penalizes missing HTTP redirect', () => {173 const scored = scoreHsts({174 hasHsts: true,175 parsed: parseHstsHeader('max-age=31536000; includeSubDomains; preload'),176 classification: 'preload-eligible',177 httpsRedirectOk: false,178 validCertificate: true,179 });180 assert.equal(scored.score, 55);181 assert.ok(scored.issues.some((i) => i.includes('did not redirect')));182});183
184test('scoreHsts penalizes certificate problems', () => {185 const scored = scoreHsts({186 hasHsts: true,187 parsed: parseHstsHeader('max-age=31536000; includeSubDomains; preload'),188 classification: 'preload-eligible',189 httpsRedirectOk: true,190 validCertificate: false,191 });192 assert.equal(scored.score, 55);193 assert.ok(scored.issues.some((i) => i.includes('certificate')));194});195
196test('scoreHsts flags extra directives without scoring penalty for them alone', () => {197 const scored = scoreHsts({198 hasHsts: true,199 parsed: parseHstsHeader('max-age=31536000; includeSubDomains; preload; report-uri="https://example.com/r"'),200 classification: 'preload-eligible',201 httpsRedirectOk: true,202 validCertificate: true,203 });204 assert.equal(scored.score, 100);205 assert.ok(scored.issues.some((i) => i.includes('Unrecognized directive')));206});207
208test('scoreHsts never returns a score out of bounds', () => {209 const scored = scoreHsts({210 hasHsts: true,211 parsed: parseHstsHeader('max-age=-5; report-uri="x"'),212 classification: 'invalid',213 httpsRedirectOk: false,214 validCertificate: false,215 });216 assert.ok(scored.score >= 0 && scored.score <= 100);217});218
219/* --- normalizeAndValidateUrl: SSRF boundaries --------------------------- */220
221test('normalizeAndValidateUrl rejects private IPv4 literals', async () => {222 await assert.rejects(() => normalizeAndValidateUrl('http://192.168.1.1/'), /Private IPv4/);223});224
225test('normalizeAndValidateUrl rejects localhost', async () => {226 await assert.rejects(() => normalizeAndValidateUrl('http://localhost/'), /private/i);227});228
229test('normalizeAndValidateUrl rejects loopback IP', async () => {230 await assert.rejects(() => normalizeAndValidateUrl('http://127.0.0.1/'), /Private IPv4/);231});232
233test('normalizeAndValidateUrl rejects URL credentials', async () => {234 await assert.rejects(() => normalizeAndValidateUrl('https://user:pass@example.com/'), /credentials/i);235});236
237test('normalizeAndValidateUrl rejects non-HTTP schemes', async () => {238 await assert.rejects(() => normalizeAndValidateUrl('file:///etc/passwd'), /Only HTTP and HTTPS/);239 await assert.rejects(() => normalizeAndValidateUrl('ftp://example.com/'), /Only HTTP and HTTPS/);240});241
242test('normalizeAndValidateUrl rejects private IPv6 literals', async () => {243 await assert.rejects(() => normalizeAndValidateUrl('http://[::1]/'), /Private IPv6/);244 await assert.rejects(() => normalizeAndValidateUrl('http://[fd00::1]/'), /Private IPv6/);245});246
247test('normalizeAndValidateUrl accepts a public https URL', async () => {248 const url = await normalizeAndValidateUrl('https://example.com/');249 assert.equal(url.hostname, 'example.com');250});251
252test('normalizeAndValidateUrl prepends https scheme to bare hosts', async () => {253 const url = await normalizeAndValidateUrl('example.com');254 assert.equal(url.protocol, 'https:');255});256
257test('normalizeAndValidateUrl rejects missing input', async () => {258 await assert.rejects(() => normalizeAndValidateUrl(''), /required/i);259 await assert.rejects(() => normalizeAndValidateUrl(null), /required/i);260});261
262/* --- auditHstsPreload: pipeline error paths ----------------------------- */263
264test('auditHstsPreload returns a structured error for private IP input', async () => {265 const result = await auditHstsPreload({ startUrl: 'https://192.168.0.1/' });266 assert.equal(result.ok, false);267 assert.equal(result.error !== null, true);268 assert.equal(result.grade, 'F');269 assert.equal(result.hasHsts, false);270});271
272test('auditHstsPreload returns a structured error for unreachable host', async () => {273 const result = await auditHstsPreload({274 startUrl: 'https://hsts-preload-auditor-nonexistent-invalid.example/',275 timeoutSeconds: 3,276 });277 assert.equal(result.ok, false);278 assert.equal(result.error !== null, true);279 assert.equal(result.grade, 'F');280});281
282/* --- auditHstsPreload: live public smoke -------------------------------- */283
284test('auditHstsPreload smoke: github.com serves a preload-eligible HSTS header', async () => {285 const result = await auditHstsPreload({ startUrl: 'https://github.com/', timeoutSeconds: 15 });286 // Tolerate network flakiness: only assert when the fetch itself worked.287 if (result.ok) {288 assert.equal(result.hasHsts, true);289 assert.equal(result.includeSubDomains, true);290 assert.equal(result.preloadDirective, true);291 assert.equal(result.maxAgeMeetsPreload, true);292 assert.equal(result.classification, 'preload-eligible');293 assert.equal(result.score, 100);294 assert.equal(result.grade, 'A+');295 } else {296 assert.ok(result.error, 'failed smoke must carry an error message');297 }298});299
300test('auditHstsPreload smoke: example.com lacks full HSTS and reports issues', async () => {301 const result = await auditHstsPreload({ startUrl: 'https://example.com/', timeoutSeconds: 15 });302 if (result.ok) {303 assert.equal(result.inputUrl, 'https://example.com/');304 assert.equal(typeof result.score, 'number');305 assert.equal(Array.isArray(result.issues), true);306 assert.equal(Array.isArray(result.recommendations), true);307 assert.equal(result.classification !== null, true);308 assert.equal(result.checkedAt.includes('T'), true);309 } else {310 assert.ok(result.error, 'failed smoke must carry an error message');311 }312});