> ## Documentation Index
> Fetch the complete documentation index at: https://docs.qaos.machdel.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Cryptography

> Misconfigured security headers and CORS misconfigurations.

## Cryptographic vulnerabilities expose data in transit or allow traffic interception. These issues typically stem from missing or misconfigured security headers and overly permissive CORS policies.

## misconfigured-security-headers

<Badge>High</Badge>

**What it is**

HTTP response headers that protect against common browser-side attacks are missing or misconfigured. These include HSTS, Content-Security-Policy, X-Frame-Options, and X-Content-Type-Options.

**Why it matters**

Security headers are the browser's last line of defense. Missing headers leave users vulnerable to downgrade attacks, clickjacking, MIME-type sniffing, and XSS escalation — even if the application code itself is secure.

**How QAOS detects it**

The agent checks HTTP response headers for the presence and correctness of key security headers.

**Commonly missing headers**

| Header                      | Risk if missing        |
| --------------------------- | ---------------------- |
| `Strict-Transport-Security` | HTTP downgrade attacks |
| `Content-Security-Policy`   | XSS escalation         |
| `X-Frame-Options`           | Clickjacking           |
| `X-Content-Type-Options`    | MIME sniffing          |
| `Referrer-Policy`           | URL leakage            |

**How to fix**

Add these headers to your server's response:

```http theme={null}
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: default-src 'self'; script-src 'self'
X-Frame-Options: DENY
X-Content-Type-Options: nosniff
Referrer-Policy: strict-origin-when-cross-origin
```

Most frameworks support middleware for this:

```javascript theme={null}
// Express.js with Helmet
const helmet = require('helmet')
app.use(helmet())
```

***

## misconfigured-cors

<Badge>High</Badge>

**What it is**

The server returns `Access-Control-Allow-Origin: *` (or reflects any origin) on endpoints that return sensitive data, allowing any website to make authenticated cross-origin requests and read the response.

**Why it matters**

A wildcard CORS policy combined with `Access-Control-Allow-Credentials: true` allows any malicious website to make requests to your API on behalf of your logged-in users and read the response. This effectively bypasses the Same-Origin Policy.

**How QAOS detects it**

The agent checks HTTP response headers for `Access-Control-Allow-Origin: *` or reflected origin values on sensitive API endpoints.

**Examples**

```http theme={null}
# Vulnerable: wildcard CORS on authenticated API
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
```

**How to fix**

Maintain an explicit allow-list of trusted origins and validate against it:

```python theme={null}
# FastAPI CORS middleware
from fastapi.middleware.cors import CORSMiddleware
app.add_middleware(
    CORSMiddleware,
    allow_origins=["https://app.example.com"],  # explicit list, never "*"
    allow_credentials=True,
    allow_methods=["GET", "POST"],
)
```