Content Security Policy & Cookie Security Checker

csp_seccookie_check.sh

#!/bin/bash
#
# This script will check for the existence of:
#   (1) Content-Security-Policy
#   (2) Insecure cookies within the response header 
#
# This can be executed directly into shell by using curl pipe bash e.g.:
#   curl -s rawscripturl.url | bash -s url.to.validate.com
# 
[ -z "$1" ] && { echo "No argument supplied" && exit 1; }

echo "Validating: $1" 
RESPONSE=$(curl -ILk --silent $1)
echo '[+] This will show the insecure cookies'
echo "$RESPONSE" | grep -E '^Set-Cookie' | grep -E -v 'Secure\W*$' || echo -e "none\t[ ok ]"
echo
echo '[+] This will show the current Content Security Policy'
echo "$RESPONSE" | grep -E '^Content-Security-Policy' || echo -e "none\t[fail]"
echo