Introduction

📦 This repository contains all the content of the OWASP Secure Headers Project (also named OSHP).

OSHP Web URL

ℹ️ The url https://owasp.org/www-project-secure-headers redirect to the project page on the OWASP site.

• Project page on the OWASP site: https://owasp.org/projects/secure-headers-project
• Web rendering of the main site: https://secure-headers-project.owasp.org

OSHP ecosystem

🗺️ The OSHP project is composed of the following projects:

• Main site: It is the core of the OSHP and provide the information about HTTP security headers.
  • Called mainsite.
  • Content is here.
    • It is the master data in markdown and is the content that is updated.
  • Web rendered content is here. It is based on the the master data in markdown and use the GitHub pages feature.
  • GitHub pages original URL is https://owasp.github.io/secure-headers-project/.
• Validator: Venom tests suite to validate an HTTP security response headers configuration against OSHP recommendation.
  • Called validator.
  • Content is here.
• Statistics: Statistics about HTTP response security headers usage mentioned by the OSHP.
  • Called statistics.
  • Content is here.

Repository structure

• The base of the repository contains the main site.
• The other projects are stored in the folder subprojects: Each sub projects have it own folder.
• The project official logo is stored into the folder logo as well as into the OWASP Swag GitHub repository.
• The folder ci (CI for Continuous Integration) contains materials to generate or update content using GitHub actions workflows.

GitHub actions

📝 The naming convention used is [project_call_name]_[action]_[target].yml where:

• [project_call_name] is the project call name defined above.
• [action] can be (validate|monitor|generate).

🔋 Health status:

Status	File
	📄
	📄
	📄
	📄
	📄
	📄
	📄
	📄
	📄

Issue and discussions

💬 Both are handled using the following GitHub features:

• Issues.
• Discussions.

Content editor

👩‍💻 Content editing is done with Visual Studio Code.

📦 A workspace file is provided with recommended extensions.

Social media communication

📩 This template is used to announce news on social media about OSHP update:

📡 OWASP Secure Headers Project: [MESSAGE].

#appsec #appsecurity #owasp_shp

[PRINT_SCREEN_IN_PNG_FORMAT_WHEN_APPLICABLE]

📖 [LINK_TO_OSHP_SECTION]

💡 Source used:

[LINK_TO_SOURCE_USED]

Project leaders

🧑‍💻 Ricardo Iramar

🧑‍💻 Dominique Righetto

Contributors

💌 Contributors to OSHP, before the migration of the project to GitHub:

• Alexandre Menezes
• Adam Averay
• Jim Manico

💌 Visit this page for updated information about the contributors since the migration of the project to GitHub.

Licensing