Browser Security Headers Pack — SAMPLE
SAMPLE Permissions-Policy / Referrer-Policy / XCTO / XFO header pack.
Security
The security category is a first-class hub for auth and PKI SAMPLE fixtures — published sample-only material that must never be used as a real identity. It deepens certificate and key coverage under permanent /files/security/… paths (the older data/security paths remain shipped and unchanged). Expect self-signed X.509 certificates and CSRs, RSA/Ed25519 keys, PKCS#12 SAMPLE bundles, JWT algorithm variants (none/HS/RS), JWKS documents, OAuth token-response JSON, CORS and CSP header text, htpasswd variants, and SSH known_hosts samples. Every private key and token is labelled SAMPLE and deliberately committed for parser, TLS, and auth-harness tests.
Filter security on Browse · 58 files · 8 subcategories
58 of 58 files
Headers
Content-Security-Policy Header — SAMPLE
SAMPLE CSP header line for CSP parsers and security-header scanners.
CORS Misconfigured Headers — SAMPLE
Intentionally misconfigured CORS SAMPLE (* + credentials) for policy linters.
CORS Response Headers — SAMPLE
SAMPLE CORS response header block as plain text for header parsers and policy tests.
Security Header — Content Security Policy Report
SAMPLE HTTP security header fixture (content-security-policy-report) for scanner regression.
Security Header — Cross Origin Embedder
SAMPLE HTTP security header fixture (cross-origin-embedder) for scanner regression.
Security Header — Cross Origin Opener
SAMPLE HTTP security header fixture (cross-origin-opener) for scanner regression.
Security Header — Cross Origin Resource
SAMPLE HTTP security header fixture (cross-origin-resource) for scanner regression.
Security Header — Expect Ct Legacy
SAMPLE HTTP security header fixture (expect-ct-legacy) for scanner regression.
Security Header — Permissions Policy
SAMPLE HTTP security header fixture (permissions-policy) for scanner regression.
Security Header — Referrer Policy Strict
SAMPLE HTTP security header fixture (referrer-policy-strict) for scanner regression.
Security Header — Strict Transport Security
SAMPLE HTTP security header fixture (strict-transport-security) for scanner regression.
Security Header — X Content Type Options
SAMPLE HTTP security header fixture (x-content-type-options) for scanner regression.
Security Header — X Frame Options Deny
SAMPLE HTTP security header fixture (x-frame-options-deny) for scanner regression.
X-XSS-Protection Header — SAMPLE
SAMPLE X-XSS-Protection: 0 header for legacy header scanners.
Htpasswd
htpasswd (APR1 MD5) — SAMPLE
SAMPLE htpasswd using Apache APR1 MD5-style hash for legacy Basic-auth tests.
htpasswd (bcrypt) — SAMPLE
SAMPLE htpasswd with a bcrypt hash line for Basic-auth file parsers.
htpasswd (Mixed Algorithms) — SAMPLE
Multi-user SAMPLE htpasswd mixing bcrypt, APR1, and {SHA} lines for algorithm-detection tests.
Jwks
JWKS (Empty Keys) — SAMPLE
Empty JWKS keys array for edge-case JWKS loaders.
JWKS (RSA) — SAMPLE
SAMPLE JWKS document exposing the Wave G RSA public key for JWT signature verification tests.
Jwt
JWT — Intentionally Invalid Segments
Intentionally invalid JWT (truncated) for parser error-path tests.
JWT (HS256 Expired) — SAMPLE
SAMPLE HS256 JWT with a past exp claim — for expiry-validation harnesses.
JWT (HS256) — SAMPLE
SAMPLE JWT with alg=HS256 for auth parsers and algorithm-handling tests. Published sample material only.
JWT (HS384) — SAMPLE
SAMPLE JWT with alg=HS384 for auth parsers and algorithm-handling tests. Published sample material only.
JWT (HS512) — SAMPLE
SAMPLE JWT with alg=HS512 for auth parsers and algorithm-handling tests. Published sample material only.
JWT (none) — SAMPLE
SAMPLE JWT with alg=none for auth parsers and algorithm-handling tests. Published sample material only.
JWT (RS256) — SAMPLE
SAMPLE JWT with alg=RS256 for auth parsers and algorithm-handling tests. Published sample material only.
JWT (RS384) — SAMPLE
SAMPLE JWT with alg=RS384 for auth parsers and algorithm-handling tests. Published sample material only.
JWT (RS512) — SAMPLE
SAMPLE JWT with alg=RS512 for auth parsers and algorithm-handling tests. Published sample material only.
JWT Header Claims — RS256 SAMPLE
JWT Header Claims — RS256 SAMPLE — unsigned JSON companion for claim-parser tests (not a live token).
JWT Payload — Expired SAMPLE
JWT Payload — Expired SAMPLE — unsigned JSON companion for claim-parser tests (not a live token).
Oauth
OAuth Device Code Response — SAMPLE
SAMPLE OAuth device-authorization response for device-flow client tests.
OAuth Error — Insufficient Scope
OAuth 2.0 SAMPLE error JSON (insufficient_scope) for client error-path tests.
OAuth Error — Invalid Client
OAuth 2.0 SAMPLE error JSON (invalid_client) for client error-path tests.
OAuth Error — Invalid Grant
OAuth 2.0 SAMPLE error JSON (invalid_grant) for client error-path tests.
OAuth Error — Invalid Scope
OAuth 2.0 SAMPLE error JSON (invalid_scope) for client error-path tests.
OAuth Error — Temporarily Unavailable
OAuth 2.0 SAMPLE error JSON (temporarily_unavailable) for client error-path tests.
OAuth Error — Unauthorized Client
OAuth 2.0 SAMPLE error JSON (unauthorized_client) for client error-path tests.
OAuth Token Error — SAMPLE
SAMPLE OAuth error JSON for token-endpoint failure handling.
OAuth Token Introspection — SAMPLE
SAMPLE RFC 7662-style token introspection response for auth middleware tests.
OAuth Token Response — SAMPLE
SAMPLE OAuth 2.0 token endpoint JSON with access, refresh, and id_token fields.
OpenID Provider Configuration — SAMPLE
SAMPLE OpenID Connect discovery document for OIDC client and metadata parsers.
Pgp
OpenPGP Public Key (ASCII Armor) — SAMPLE Shape
ASCII-armored SAMPLE-shaped PGP public key placeholder for armor detectors (not a cryptographically valid key).
Pki
CRL Metadata JSON — SAMPLE
SAMPLE CRL metadata JSON (no binary CRL) for revocation-list UI and loader tests.
Ed25519 Private Key (PEM) — SAMPLE
Deterministic SAMPLE Ed25519 private key for SSH/TLS tooling tests.
Encrypted PKCS#8 RSA Key — SAMPLE
Password-encrypted SAMPLE PKCS#8 private key (password printed in specs) for decrypt-import tests.
PKCS#10 CSR — Security SAMPLE
PKCS#10 certificate signing request SAMPLE for CSR parsers and CA tooling smoke tests.
PKCS#12 Bundle (.p12) — SAMPLE
SAMPLE PKCS#12 keystore (password `novus-sample-wg`) for keystore importer tests. Not byte-stable.
RSA-2048 Private Key (PEM) — SAMPLE
Published SAMPLE RSA-2048 private key (PKCS#8 PEM). Never use for a real identity.
X.509 Certificate (.crt) — Security SAMPLE
Same SAMPLE certificate as .crt (PEM bytes) for tools that expect the CRT extension.
X.509 Certificate (DER) — Security SAMPLE
DER-encoded twin of the Wave G SAMPLE certificate for binary X.509 decoders.
X.509 Certificate (PEM) — Security SAMPLE
Self-signed X.509 SAMPLE certificate in PEM under /files/security/ — published sample material for TLS and PEM parsers.
X.509 Certificate Chain (PEM) — SAMPLE
Two-PEM-block SAMPLE chain file for multi-cert parsers and bundle importers.
Ssh
SSH authorized_keys — SAMPLE
Single-entry SAMPLE authorized_keys file for SSH access-control parsers.
SSH Config — SAMPLE
SAMPLE OpenSSH client config stanza for SSH config parsers.
SSH Ed25519 Public Key — SAMPLE
OpenSSH-format SAMPLE Ed25519 public key for authorized_keys and SSH parsers.
SSH known_hosts — SAMPLE
SAMPLE SSH known_hosts with fictional hostnames for known_hosts parsers and StrictHostKeyChecking tests.
Frequently asked questions
Are these real certificates or secrets?
Never. Every key, cert, JWT, and token is published SAMPLE-only material under /files/security/… — do not use them as real identities. Older data/security paths remain shipped and unchanged.
What JWT algorithms are included?
SAMPLE JWTs for none, HS256/384/512, and RS256/384/512, plus expired and intentionally invalid tokens, JWKS, and OAuth token-response JSON.
Do you include CORS and CSP examples?
Yes — plain-text header fixtures for CORS, CSP, HSTS, and a deliberately misconfigured CORS sample for policy linters.