Expect-CT in Report Only Mode
Severity:
Information
Summary
Invicti identified that Expect-CT is in report only mode. The optional enforce directive controls whether the browser should drop the connection when the policy is violated.
Impact
When Expect-CT policy is deployed in report only mode and the user agent does not receive a valid Certificate Transparency Log, rather than dropping the connection it will simply send a report to the specified endpoint which is set with report-uri directive.
Remediation
Use enforce flag in definition of Expect-CT.
Expect-CT: enforce, max-age=7776000, report-uri="https://ABSOLUTE_REPORT_URL"
Required Skills for Successful Exploitation
Actions To Take
Classifications
Vulnerability Index
You can search and find all vulnerabilities
Select Category
Select Vulnerability
Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.
Select Vulnerability
Empfohlene Ressourcen
Build your resistance to threats. And save hundreds of hours each month.
