Browser Security Headers Pack — SAMPLE
SAMPLE Permissions-Policy / Referrer-Policy / XCTO / XFO header pack.
Permissions-Policy: geolocation=(), microphone=(), camera=(), payment=(self)
Referrer-Policy: strict-origin-when-cross-origin
X-Content-Type-Options: nosniff
X-Frame-Options: DENY
Specifications
- Headers
- 4
What is a .headers file?
A .headers text fixture is a plain-text dump of HTTP response headers (CORS, CSP, HSTS, etc.) used for policy and scanner tests.
How to use this file
Use SAMPLE .headers files to test security-header parsers and linters against documented good and misconfigured policies.
How to use this file for testing
“Browser Security Headers Pack — SAMPLE” is a deterministic Novus Examples fixture for API testing. OpenAPI/Swagger specs, GraphQL SDL, JSON Schema, paginated and problem+json error payloads, and webhook samples — for testing API clients, mock servers, contract tests, and schema validators.
Documented properties for this file: HEADERS · 184 bytes. Compare results against paired or grouped companions on this page when present (clean↔damaged, searchable↔scanned, or format twins) so scores stay reproducible across runs.
Download the file once, keep the path stable in CI or local scripts, and treat the spec table as the contract: dimensions, seeds, field lists, and roles are intentional. Corrupt or invalid samples are labelled as such — expect parsers to fail loudly rather than silently accept them.
This is published, SAMPLE-only security material — never a real secret. Point certificate, key, or token parsers at it, test PEM/DER decoding and PKCS handling, and confirm your tooling reads the documented fields; any sample password is printed on this page.
Related files
- headersContent-Security-Policy Header — SAMPLESAMPLE CSP header line for CSP parsers and security-header scanners.
- headersCORS Misconfigured Headers — SAMPLEIntentionally misconfigured CORS SAMPLE (* + credentials) for policy linters.
- headersCORS Response Headers — SAMPLESAMPLE CORS response header block as plain text for header parsers and policy tests.
- headersHSTS Header — SAMPLESAMPLE Strict-Transport-Security header for TLS policy scanners.
- headersX-XSS-Protection Header — SAMPLESAMPLE X-XSS-Protection: 0 header for legacy header scanners.
- jsonOAuth Device Code Response — SAMPLESAMPLE OAuth device-authorization response for device-flow client tests.
Generated by generation/security_wave_g.py. Free for any use, no attribution required — license.